From: dave kormann <davek@research.att.com>
Date: Wed, 16 Dec 2020 22:03:37 +0000 (-0500)
Subject: FIX: allow keystone to log in
X-Git-Url: https://gerrit.akraino.org/r/gitweb?p=ta%2Finfra-ansible.git;a=commitdiff_plain;h=c4369e76d0ea181f6e8e637f3704cb7356a9e104

FIX: allow keystone to log in

Our playbooks depend on the keystone user being able to login,
but keystone isn't a member of the allowedgroups for ssh.  This
fixes that and optimistically adds ironic as well.

signed-off-by: dave kormann  <davek@research.att.com>
Change-Id: Ia20065deab4ae4087e3a5918e891a2b73f5cbbed
---

diff --git a/roles/ssh_conf_hardening/tasks/main.yaml b/roles/ssh_conf_hardening/tasks/main.yaml
index cfc4425..66d4bce 100644
--- a/roles/ssh_conf_hardening/tasks/main.yaml
+++ b/roles/ssh_conf_hardening/tasks/main.yaml
@@ -150,10 +150,10 @@
     regexp: '[\s]*ClientAliveCountMax'
     values: "ClientAliveCountMax 0\n"
 
-- name: "Limit logins to members of {{ users['admin_user_name'] }} group"
+- name: "Limit logins to members of admin, keystone, and ironic groups"
   ssh_conf:
     regexp: '[\s]*AllowGroups'
-    values: "AllowGroups {{ users['admin_user_name'] }}\n"
+    values: "AllowGroups {{ users['admin_user_name'] }} {{ keystone_system_group_name |default('keystone') }} {{ ironic_system_group_name | default('ironic') }}\n"
 
 - name: "Disable SSH Support for User Known Hosts"
   ssh_conf: