Timotej Lazar
7a2223ea71
Define a custom SNMP group with read access only to fields we need. For D-Link switches, modifying the group must be handled the same as user, i.e. the group (and user) must be removed and readded. Untested for FS S5800.
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
- name: Get secrets for SNMP manager
|
|
set_fact:
|
|
manager: "{{ lookup('passwordstore', 'host/'+snmp_manager.name, returnall=true, missing='empty') | from_yaml }}"
|
|
|
|
- name: Get existing SNMP users
|
|
set_fact:
|
|
current_user: "{{ ansible_net_config | split('\n') | select('match', '^snmp-server usm-user '+manager.snmp_user) }}"
|
|
target_user: "snmp-server usm-user {{ manager.snmp_user }} authentication sha {{ manager.snmp_pass }} privacy des {{ manager.snmp_pass }} "
|
|
|
|
- name: Remove existing SNMP user to reset password
|
|
when: "current_user and target_user is not in current_user"
|
|
block:
|
|
- name: Remove SNMP user
|
|
ansible.netcommon.cli_config:
|
|
config: "{{ item }}"
|
|
loop:
|
|
- "no snmp-server usm-user {{ manager.snmp_user }}"
|
|
- "no snmp-server group public user {{ manager.snmp_user }} security-model usm"
|
|
notify: write config
|
|
|
|
- set_fact:
|
|
current_user: false
|
|
|
|
- name: Create SNMP user
|
|
when: "not current_user"
|
|
ansible.netcommon.cli_config:
|
|
config: "{{ item }}"
|
|
loop:
|
|
- "{{ target_user }}"
|
|
- "snmp-server group public user {{ manager.snmp_user }} security-model usm"
|
|
no_log: true
|
|
notify: write config
|