hosts

[centos-root]
192.168.174.129 ansible_ssh_port=22 
192.168.174.130 ansible_ssh_port=22  
192.168.174.131 ansible_ssh_port=22  

Ansible Vault 文件

创建 Ansible Vault 文件

# ansible-vault create passwords.yml

New Vault password:                    # 12345678
Confirm New Vault password:

编辑 Ansible Vault 文件

# ansible-vault edit passwords.yml

Vault password:

passwords.yml

hosts_passwords:
  192.168.174.129:
    yunwei_password: yunwei_129
  192.168.174.130:
    yunwei_password: yunwei_130
  192.168.174.131:
    yunwei_password: yunwei_131

check_expir_user-playbook.yaml

- hosts: centos
  remote_user: yunwei
  become: yes
  become_method: sudo
  gather_facts: no
  vars_files:
    - passwords.yml
  vars:
    ansible_ssh_pass: "{{ hosts_passwords[inventory_hostname].yunwei_password }}"
    ansible_become_pass: "{{ hosts_passwords[inventory_hostname].yunwei_password }}"
    excluded_users: "root|yunwei|sreuser|wgs|autodevops"

  tasks:
    - name: chattr -i /etc/gshadow /etc/shadow /etc/group /etc/passwd /etc/ssh/sshd_config /etc/profile
      ansible.builtin.shell:
        cmd: |
          chattr -i /etc/gshadow /etc/shadow /etc/group /etc/passwd /etc/ssh/sshd_config /etc/profile    

    - name: Get users with /bin/bash shell excluding specified users
      ansible.builtin.shell: |
        cmd: |
          awk -F: -v excluded="{{ excluded_users }}" '$7 == "/bin/bash" && !($1 ~ "^("excluded")$") {print $1}' /etc/passwd
      register: bash_users
      changed_when: false

    - name: Check if user passwords are expired and compile list of expired users
      ansible.builtin.shell: 
        cmd: |
          CURRENT_DATE=$(date +%Y-%m-%d)
          EXPIRY_DATE_STR=$(chage -l {{ item }} | grep 'Password expires' | cut -d: -f2 | xargs);
          # 检查每个用户的密码是否过期，转换日期格式后进行比较
          if [[ "$EXPIRY_DATE_STR" == "password must be changed" ]]; then
            echo "{{ item }}";
          fi
      loop: "{{ bash_users.stdout_lines }}"
      register: expired_users
      changed_when: false

    - name: Delete expired users
      ansible.builtin.user:
        name: "{{ item }}"
        state: absent
      loop: "{{ expired_users.results | selectattr('stdout', 'defined') | map(attribute='stdout') | list }}"
      when: expired_users.results | selectattr('stdout', 'defined') | list
      register: delete_users

    - name: Display removed users
      ansible.builtin.debug:
        msg: "Removed expired users: {{ delete_users.results | map(attribute='item') | list }}"
    
    - name: chattr +i /etc/gshadow /etc/shadow /etc/group /etc/passwd /etc/ssh/sshd_config /etc/profile
      ansible.builtin.shell:
        cmd: |
          chattr +i /etc/gshadow /etc/shadow /etc/group /etc/passwd /etc/ssh/sshd_config /etc/profile

测试 playbook

# ansible-playbook -i hosts check_expir_user-playbook.yaml --ask-vault-pass

Vault password: 

PLAY [centos] ******************************************************************************************************************************************************************

TASK [chattr -i /etc/gshadow /etc/shadow /etc/group /etc/passwd /etc/ssh/sshd_config /etc/profile] *****************************************************************************
changed: [192.168.174.130]
changed: [192.168.174.131]
changed: [192.168.174.129]

TASK [Get users with /bin/bash shell excluding specified users] ****************************************************************************************************************
ok: [192.168.174.131]
ok: [192.168.174.129]
ok: [192.168.174.130]

TASK [Check if user passwords are expired and compile list of expired users] ***************************************************************************************************
ok: [192.168.174.130] => (item=user1)
ok: [192.168.174.131] => (item=user1)
ok: [192.168.174.129] => (item=user1)
ok: [192.168.174.131] => (item=user2)
ok: [192.168.174.130] => (item=user2)
ok: [192.168.174.129] => (item=user2)
ok: [192.168.174.131] => (item=user3)
ok: [192.168.174.130] => (item=user3)
ok: [192.168.174.129] => (item=user3)
ok: [192.168.174.131] => (item=user4)
ok: [192.168.174.129] => (item=user4)
ok: [192.168.174.130] => (item=user4)

TASK [Delete expired users] ****************************************************************************************************************************************************
changed: [192.168.174.130] => (item=user1)
changed: [192.168.174.129] => (item=user1)
changed: [192.168.174.131] => (item=user1)
changed: [192.168.174.129] => (item=user2)
changed: [192.168.174.130] => (item=user2)
changed: [192.168.174.131] => (item=user2)
changed: [192.168.174.129] => (item=user3)
changed: [192.168.174.131] => (item=user3)
changed: [192.168.174.130] => (item=user3)
changed: [192.168.174.131] => (item=user4)
changed: [192.168.174.129] => (item=user4)
changed: [192.168.174.130] => (item=user4)

TASK [Display removed users] ***************************************************************************************************************************************************
ok: [192.168.174.129] => {
    "msg": "Removed expired users: [u'user1', u'user2', u'user3', u'user4']"
}
ok: [192.168.174.130] => {
    "msg": "Removed expired users: [u'user1', u'user2', u'user3', u'user4']"
}
ok: [192.168.174.131] => {
    "msg": "Removed expired users: [u'user1', u'user2', u'user3', u'user4']"
}

TASK [chattr +i /etc/gshadow /etc/shadow /etc/group /etc/passwd /etc/ssh/sshd_config /etc/profile] *****************************************************************************
changed: [192.168.174.129]
changed: [192.168.174.131]
changed: [192.168.174.130]

PLAY RECAP *********************************************************************************************************************************************************************
192.168.174.129            : ok=6    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
192.168.174.130            : ok=6    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
192.168.174.131            : ok=6    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0