Non interactive samba user creation via ansible

Question

Although the following command works when typing in in shell

echo -ne "myser\nmypass\n" | smbpasswd -a -s myuser

The following task fails in ansible

  - name: add dms samba user
    command: echo -ne "myuser\nmypass\n" | smbpasswd -a -s myuser
    notify: restart samba

It does not produce any errors, but the user is not created.

Working with ansible 2.3.0.0 on Ubuntu 16.0.4.

Blackshear

Possible duplicate of How to use wildcard with variable – All

Answer 1

As stated, pipes won't work with the command module. I've used something like this in the past to create Samba users:

- name: Configure Samba users.
  shell: >
    (pdbedit --user={{ item.username }} 2>&1 > /dev/null)
    || (echo '{{ item.password }}'; echo '{{ item.password }}')
    | smbpasswd -s -a {{ item.username }}
  register: smbpasswd
  changed_when: "'Added user' in smbpasswd.stdout"
  with_items: "{{ samba_users }}"
  loop_control:
    label: "{{ item.username }}"

The task will only run if the user does not exist yet. So changing passwords won't work with this example.

Curtis

Answer 2

I improved the code from siwyd and Tormod Macleod slightly. Thanks to both of you!

- name: shell - create samba users
  ansible.builtin.shell: >
    set -e -o pipefail
    && (pdbedit --user={{ item.username }} 2>&1 > /dev/null)
    || (echo '{{ item.password }}'; echo '{{ item.password }}')
    | smbpasswd -s -a {{ item.username }}
  args:
    executable: /bin/bash
  register: samba_create_users
  changed_when: "'Added user' in samba_create_users.stdout"
  loop: "{{ samba_users }}"
  no_log: true

- name: shell - set samba passwords correctly
  ansible.builtin.shell: >
    set -e -o pipefail
    && (smbclient -U {{ item.username }}%{{ item.password }} -L 127.0.0.1 2>&1 > /dev/null)
    || (echo '{{ item.password }}'; echo '{{ item.password }}')
    | smbpasswd {{ item.username }}
  args:
    executable: /bin/bash
  register: samba_verify_users
  changed_when: "'New SMB password' in samba_verify_users.stdout"
  loop: "{{ samba_users }}"
  no_log: true

Changes:

• Added pipefail to satisfy Ansible Lint (https://ansible-lint.readthedocs.io/en/latest/default_rules.html#risky-shell-pipe)
• Changed executable to /bin/bash, beacause /bin/sh doesn't know pipefail
• Added no_log to prevent password logging if the task fails
• Removed loop_control label, since logging is disabled
• Used loop instead of with_items
• Used FQCN

Titanesque

This should probably be the accepted answer. Note that ansible-lint also prefers the use of FQCNs (ansible.builtin.shell). – Jonathanjonathon

Answer 3

Please try this approach with your Ansible Playbook:

- name: set Samba passwords for each user
  shell: "printf '{{ item.passwd }}\n{{ item.passwd }}\n' | smbpasswd -a {{ item.name }}"
  with_items:
  - "{{ users }}"
  tags: smbpasswd

Please note that you will need to map your variables file that includes users: with the format of:

users:
- name: userName
  passwd: myClearTextPassword

Please note that to support smbpasswd you will be passing this password as clear text. Additionally, noting this is only a single task that would need to be included in your playbook.

Comedown

Answer 4

The answer by siwyd above is excellent. I was struggling to figure out how to solve this problem in an idempotent way until I saw this. For my use-case, I'd like to keep the passwords in sync so I've added another play to do this. Might be useful for someone

- name: shell - create samba users
  shell: >
    (pdbedit --user={{ item.username }} 2>&1 > /dev/null)
    || (echo '{{ item.password }}'; echo '{{ item.password }}')
    | smbpasswd -s -a {{ item.username }}
  register: create_samba_users
  changed_when: "'Added user' in create_samba_users.stdout"
  become: true
  with_items: "{{ samba_users }}"
  loop_control:
    label: "{{ item.username }}"

- name: shell - set samba passwords correctly
  shell: >
    (smbclient -U {{ item.username }}%{{ item.password }} -L 127.0.0.1 2>&1 > /dev/null)
    || (echo '{{ item.password }}'; echo '{{ item.password }}')
    | smbpasswd {{ item.username }}
  register: verify_samba_users
  changed_when: "'New SMB password' in verify_samba_users.stdout"
  become: true
  with_items: "{{ samba_users }}"
  loop_control:
    label: "{{ item.username }}"

Thor

Answer 5

the command module does not support pipelining. use the shell module for stuff like this.

see:

• command module
• shell module

Thin

Answer 6

Another variant using dictionary lists:

ad_users: [
             { username: john.doe, password: P4ssw0rd*, givenname: John, surname: Doe, mail: john.doe@domain, ou: "OU=Department,OU=Division" },
             { username: jane.doe, password: P455w0rd*, givenname: Jane, surname: Doe, mail: jane.doe@domain, ou: "OU=Department,OU=Division" },
             ]


- name: Add user to AD
  command: samba-tool user create {{ item.username }} {{ item.password }} --given-name='{{ item.givenname }}' --surname='{{ item.surname }}' --mail-address={{ item.mail }} --userou='{{ item.ou }}'
  loop: "{{ ad_users }}"

Just remember to vault sensitive data.

Credential

samba-tool will work ONLY for computers with ActiveDirectory (Windows network). This does not cover typical cases when Samba is configured as FileServer. – Kilter