如何用Ansible为树莓派创建带密钥登录的sudo用户并要求首次设密码

可以在现有配置基础上完成需求，需要两步核心操作：给用户设置密码、配置sudoers让admin组拥有需密码验证的sudo权限，以下是具体实现：

1. 先修正原有Ansible任务的语法错误 #

原任务存在YAML缩进问题（模块参数未正确缩进、with_items位置错误），先修正为可正常运行的格式：

- name: Ensure group "admin" exists
  ansible.builtin.group:
    name: admin
    state: present

- name: Create users
  ansible.builtin.user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
    state: present
  with_items: "{{ user_details }}"

- name: Add authorized_key to host
  ansible.builtin.authorized_key:
    user: "{{ item.name }}"
    state: present
    key: "{{ lookup('file', item.pkey) }}"
  with_items: "{{ user_details }}"

2. 为用户设置sudo验证所需的密码 #

sudo需要验证用户自身密码，所以必须给每个用户设置加密后的密码，有两种常用方式：

方式一：预存密码哈希（推荐生产环境使用） #

先通过命令行生成SHA-512加密的密码哈希：

openssl passwd -6

将生成的哈希值添加到用户变量中：

---
user_details:
   - { name: user_1, groups: "admin", pkey: "vars/pub_keys/user_1.pub", password_hash: "$6$rounds=4096$xxxxxx..." }

然后修改创建用户的任务，添加密码参数：

- name: Create users with password
  ansible.builtin.user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
    state: present
    password: "{{ item.password_hash }}"
    update_password: on_create  # 仅在创建用户时设置密码，后续不覆盖修改
  with_items: "{{ user_details }}"

方式二：动态生成密码（适合批量测试场景） #

如果需要快速批量生成密码，可以用Ansible的password_hash过滤器：

- name: Create users with dynamically generated password
  ansible.builtin.user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
    state: present
    password: "{{ item.default_password | password_hash('sha512') }}"
    update_password: on_create
  with_items: "{{ user_details }}"

对应的变量配置：

---
user_details:
   - { name: user_1, groups: "admin", pkey: "vars/pub_keys/user_1.pub", default_password: "User1SecurePass!" }

3. 配置sudoers允许admin组使用sudo并验证密码 #

用lineinfile模块向/etc/sudoers添加规则，确保admin组用户执行sudo时必须验证自身密码：

- name: Grant admin group sudo access with password requirement
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    state: present
    regexp: '^%admin'
    line: '%admin ALL=(ALL) ALL'
    validate: '/usr/sbin/visudo -cf %s'  # 验证sudoers文件语法，避免配置错误导致无法使用sudo

这条规则的作用是：允许admin组的所有用户，在所有主机上以任何用户身份执行所有命令，且必须输入自身密码验证。

完整的Ansible任务示例 #

- name: Ensure group "admin" exists
  ansible.builtin.group:
    name: admin
    state: present

- name: Create users with password
  ansible.builtin.user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
    state: present
    password: "{{ item.password_hash }}"
    update_password: on_create
  with_items: "{{ user_details }}"

- name: Add authorized_key to host
  ansible.builtin.authorized_key:
    user: "{{ item.name }}"
    state: present
    key: "{{ lookup('file', item.pkey) }}"
  with_items: "{{ user_details }}"

- name: Grant admin group sudo access with password requirement
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    state: present
    regexp: '^%admin'
    line: '%admin ALL=(ALL) ALL'
    validate: '/usr/sbin/visudo -cf %s'

对应的变量文件：

---
user_details:
   - { name: user_1, groups: "admin", pkey: "vars/pub_keys/user_1.pub", password_hash: "$6$rounds=4096$your_generated_hash_here" }

内容的提问来源于stack exchange，提问作者KapaA