Create new user and delete current user 'ubuntu' with ansible-playbook

Question

I want to automate some provisioning on raspberry pi or oracle cloud with Ansible.

Those are tasks sequence:

1. run the script with current/default/unsafe user 'ubuntu'

ansible-playbook security.yml -u ubuntu

2. playbook will create new user

    - name: create a new safe user
      user:
        name: "{{ safe_user }}"
        state: present
        groups: "sudo"
        password: "{{ password }}"
        comment: "Safe user"
        shell: /bin/bash
        update_password: on_create

3. playbook will ensure authorized_keys file exists for safe user created in 2nd step

4. playbook will delete unsafe user 'ubuntu'

5. playbook will continue to set fail2ban, ufw, Change ssh port ... but now with 'safe_user'

It fails on step 4-5 because it's trying to continue all next tasks with Ubuntu user while the Ubuntu user is wiped from the system.

Is it possible to specify on step 5 to reconnect back with <safe_user> ?

At the moment I split all my tasks into two files, but I would like to have just one.

$ ansible-playbook security-1.yml -u ubuntu # will create safe_user
$ ansible-playbook security-2.yml -u safe_user # will delete ubuntu user

You may ask why I want to remove user ubuntu ?

1. It is because I feel more safe when bad people do not have option to log with ubuntu or pi user.
2. I want to understand more deeper the ansible limitation.

Answer 1

I don't think it is possible at all (not in ansible only but basically), simply because there are no mechanisms to disown or reown a running process or somehow else impersonate it.

Why you need to create a new user and remove another one, if you could rename the second in the former? I don't know how it would be in ansible, but the shell command would be something like that:

usermod -l safe_user ubuntu

If you want to delete the user anyway, you could either move this action to the last step, so there will be no tasks after the removal. Or execute the remaining tasks in extra script (playbook) under su -c '...' safe_user (no idea whether ansible such "nesting" supported).

Another variant would be to disable or lock the user (usermod -L ubuntu) or its login (usermod ubuntu -s /sbin/nologin) instead of the full removal.