I want to automate some provisioning on raspberry pi or oracle cloud with Ansible.
Those are tasks sequence:
- run the script with current/default/unsafe user 'ubuntu'
ansible-playbook security.yml -u ubuntu
- playbook will create new user
- name: create a new safe user
user:
name: "{{ safe_user }}"
state: present
groups: "sudo"
password: "{{ password }}"
comment: "Safe user"
shell: /bin/bash
update_password: on_create
playbook will ensure authorized_keys file exists for safe user created in 2nd step
playbook will delete unsafe user 'ubuntu'
playbook will continue to set fail2ban, ufw, Change ssh port ... but now with 'safe_user'
It fails on step 4-5 because it's trying to continue all next tasks with Ubuntu user while the Ubuntu user is wiped from the system.
Is it possible to specify on step 5 to reconnect back with <safe_user> ?
At the moment I split all my tasks into two files, but I would like to have just one.
$ ansible-playbook security-1.yml -u ubuntu # will create safe_user
$ ansible-playbook security-2.yml -u safe_user # will delete ubuntu user
You may ask why I want to remove user ubuntu ?
- It is because I feel more safe when bad people do not have option to log with ubuntu or pi user.
- I want to understand more deeper the ansible limitation.