Sets up a backup user with passwordless sudo. Sets up key-based ssh authentication automatically.

backup_user_setup.yml

---
- name: Set up backup user to be used by Ansible
  hosts: all
  remote_user: <an existing user>

  roles:
   - yaegashi.blockinfile

  tasks:
   - name: Generate a unique key for this host
     local_action: command /usr/bin/ssh-keygen -b 2048 -t rsa -f /etc/ansible/sshkeys/{{ inventory_hostname }} -q -N ""
     become: no

   - name: Create /backup/.ssh recursively
     file: path=/backup/.ssh state=directory owner=backup group=backup mode=0700 recurse=yes

   - name: Change backup user home to /backup and shell to bash
     user: name=backup
           home=/backup
           shell=/bin/bash

   - name: Add public key to backup user
     authorized_key: user=backup
                     key="{{ lookup('file', '/etc/ansible/sshkeys/'+inventory_hostname+'.pub') }}"
                     state=present

   - name:  Set up passwordless sudo for backup user
     lineinfile: "dest=/etc/sudoers
                 regexp='^backup ALL'
                 line='backup ALL=(ALL:ALL) NOPASSWD: ALL'
                 state=present
                 insertafter=EOF"

   - name: Disallow password login for SSH for backup user
     blockinfile:
       dest: /etc/ssh/sshd_config
       block: |
         Match User backup
           PasswordAuthentication no
     notify:
        - restart ssh

  handlers:
   - name: restart ssh
     service: name=ssh state=restarted