Section 12 Flashcards
Configure a New RHEL Managed Node
user password should be configured
a password should be set
Run root commands with no password and in wheel group
Register RHEL subscription
username and pass in ansible vault
add subscriptions rh-gluster-3-client-for-rhel-9-for-x86_64-rpms
and
rhel-8-for-x86_64-appstream-debug-rpms
use tags
Add new host info in inventory
Setup whatever you need to get the host running
sudo dnf install sshpass (because we’ll be working with ssh passwords in a non-interactive way)
- name: Add host to inventory
hosts: localhost
tasks:- fail:
msg: “Add the options -e newhost=hostname -e newhostip=ip and try again”
when: (newhost is undefined) or (newhostip is undefined)
- fail:
- name: Add a new host to the inventory
lineinfile:
path: inventory
state: present
line: “{{ newhost }}” - name: Add new host to /etc/hosts
lineinfile:
path: /etc/hosts
state: present
line: “{{ nowhostip }} {{ newhost }}”
tags: addhost
second play
- name: Configure a new RHEL host
hosts: “{{ newhost }}”
remote_user: root
become: false
tasks:
- name: Configure user ansible
user:
name: ansible
groups: wheel
append: yes
state: present
- name: Set user password
shell: 'echo password | passwd --stdin ansible'
- name: Enable sudo without password
lineinfile:
path: /etc/sudoers
regexp: '*%wheel'
line: '%wheel ALL=(ALL) NOPASSWD: ALL'
validate: /usr/sbin/visudo -cf %s
- name: Create SSH directory in user ansible home
file:
path: /home/ansible/.ssh
state: directory
owner: ansible
group: ansible- name: Copy SSH public key to remote host copy: src: /home/ansible/.ssh/id_rsa.pub dest: /home/ansible/.ssh/authorized_keys tags: setuphost (He's putting the tags on the same line as the - in - name)
If you want to test so far:
ansible-playbook -C -k site.yml -e newhost=ansible3 -e newhostip=192.168.10.123 (the k asks for root password)
Now let’s go add our RedHat subscription creds to a file
ansible-vault create info.vault.yml
rhsm_user: username
rhsm_pass: user_pass
Now we can finish the original playbook with our final play
- name: Use subscription manager to register and sertup repos
hosts: “{{ newhost }}”
vars_files:- info.vault.yml
tasks: - name: Register and subscribe {{ newhost }}
redhat_subscription:
username: “{{ rhsm_user }}”
password: “{{ rhsm_pass }}”
state: present - name: Configure additional repo access
rhsm_repository:
name:- rh-gluster-3-client-for-rhel-9-x86_64-rpms
- rhel-8-for-x86_64-appstream-debug-rpms
state: present
- info.vault.yml
now let’s run it
ansible-playbook -k –ask-vault-pass site.yml -e newhost=ansible3 -e newhostip=192.168.10.123
-
In terms of the user module how do you add a primary and secondary groups for a user? How do you not overwrite previous secondary groups?
Create an ssh key for them that’s 2048 bits and store the private key in the user’s private file
user:
name: anna
create_home: true
groups: wheel,students
append: true
generate_ssh_key: true
ssh_key_bits: 2048
ssh_key_file: .ssh/id_rsa
groups is for extended groups
group would be for primary, but it will make one with the same username automatically.
How would you write the header of a play so that you can login and performs commands without ssh keys being setup
- name: Whatever
hosts: “{{ variable }}”
remote_user: root
become: false
How do you add variables to your playbook via parameters
ansible-playbook -e var1 -e var2 site.yml
How would you change a the user ansible’s password to ‘password’ via a playbook?
shell: ‘echo password | passwd –stdin ansible’
How would you change the wheel group to not ask for passwords?
- name: Enable sudo without password
lineinfile:
path: /etc/sudoers
regexp: ‘*%wheel’
line: ‘%wheel ALL=(ALL) NOPASSWD: ALL’
validate: /usr/sbin/visudo -cf %s
Name what the following directories and files do:
.ssh/
id_rsa
id_rsa.pub
authorized_keys
known_hosts
config
.ssh/ - user ssh directory
id_rsa - private key for user
id_rsa.pub - public key corresponding to id_rsa
authorized_keys - file that stores the public keys of all users who are allowed to log into this user’s account via ssh
known_hosts - ssh clients store the fingerprints of remote servers to verify the server’s id on subsequent connections
config - user specific ssh configs
known_hosts
config
Manually create ssh keys and use them
Create asymmetric keys (public and private keys, public encrypts data and private decrypts it)
ssh-keygen -t rsa -b 4096
What’s the difference between symmetric and asymmetric encryption?
Asymmetric - pub and priv
DSA - diffie hellman base
ECC - RSA is one of these
pgp
gpg
symmetric - one key, much faster than asymmetric
AES
DES
3DES
hashing (non-reversable/ verifies integrity) - Not encryption, creates fixed length string based on input data.
MD5
SHA
Create ssh logins on your own for an ansible host that isn’t setup yet
What keys do you copy?
You copy id_rsa.pub to the hosts authorized_keys
- name: Create SSH directory in user ansible home
file:
path: /home/ansible/.ssh
state: directory
owner: ansible
group: ansible- name: Copy SSH public key to remote host copy: src: /home/ansible/.ssh/id_rsa.pub dest: /home/ansible/.ssh/authorized_keys tags: setuphost (He's putting the tags on the same line as the - in - name)
What are the steps for managing a new ansible host
Around 6 steps
Login as root
Add hostname and ip to /etc/hosts and inventory, login as root (become false, remote_user root)
Configure user, allow wheel no passwd, put user in wheel, give password
Create SSH directory and copy keys
register user in redhat subscriptions
give subscriptions to user
The HOSTess cake brings you in to see a big warehouse full of INVENTORY. He tells you you haven’t been pulling your wait and he’s hiring a new manager, a drug addict lying on the ground. He tosses the keys to the warehouse on him and takes you to a door in the back. “Here’s your new office”, he laughs. Opening the door you see a man in a gimp suit and a red hat being nasty with the floor.
Create a group named students and place a new user into that group and wheel.
Make sure to setup ssh keys for the user
group:
name: students
state: present
user:
name: nathan
create_home: true
groups: student,wheel
append:
generate_ssh_key: true
ssh_key_bits: 2048
ssh_key_file: .ssh/id_rsa
Create multiple groups that need sudo access and multiple groups that don’t need sudo access via a variable file.
Now create a template that gives sudo access to the groups that require it
Create a playbook that creates the users and groups and adds them necessary groups to sudo that need to be
Page 311
sudo_groups:
- name: developers
group_id: 5000
sudo: false
- name: admins
group_id: 5001
sudo: true
{% for item in sudo_groups % }
{ % if item.sudo }
%{{ item.name }} ALL=(ALL:ALL) NOPASSWD:ALL
{% endif %}
{% endfor %}
What is the process for logging in via ssh
User contacts ssh server
Server sends pub host key to id itself (id token)
Client checks key again a list of known hosts (known_hosts)
If this is the first time logging in it will ask you to trust and save it
Shared Secret established for encryption
or
Verify ID if saved host key
User can either enter a password now or generate an authentication token based on user’s private key
If token used, based on user’s private key, token is received by server which matches against user’s pub keys authorized_keys
If this fails, password is ran
Client contacts server via ssh
Server sends pub host key to ID itself
Client checks known_hosts
Client and server establish encryption
client proves ID SSH agent of client uses private key to sign challenge
Server checks signature against any matching pub key in authorized_keys
Adventurer goes to kingdom gate and knocks on the door.
Gatekeeper shows a glowing key (pub host key)
Adventurer checks his journal (known hosts) and finds a match
He recites a magic incantation and they now speak in a language only they can hear
The gatekeeper now proof he is who he says he is. The adventurer shows him his private key which reflects his true identity.
Th guard checks his journal of authorized_keys and nods.
SSH process Castle
__________________________________
Verifying Both Ends
An adventurer knocks on the castle door (establish connection)
A guard opens a tiny space in the door and shows a magical royal seal (public host key used to verify the private key)
The adventurer checks his notebook to see if he knows of this seal. If he doesn’t, he can choose to learn this and record it.
(adds or checks pub key in known_hosts)
The client uses the seal to bless his speech, allowing him to speak in the mystic language of the mysterious community behind the door.
Now no one can understand their specific conversation.
____________________________________
Authentication
Now that they both know they are who they say they are and can speak privately:
The adventurer offers dull copy of his family ring to the guard
The guard inspects it, shuffles for something behind the door, and comes back displaying a crude wooden puzzle that only he can solve with a bright light from his family ring.
The adventurer solves it, and then signs the bottom of the puzzle with his ring hand using his family’s signature.
If the ring doesn’t match then the guard asks the adventurer for a secret password
What can you use to access data from outside sources, like reading file systems, or contact external datastores and services?
The lookup module
Store the contents of /etc/hosts into a variable called file_contents
- name: demo
hosts: localhost
vars:
file_content: “{{ lookup(‘file’, ‘etc/hosts/) }}”
tasks:- name: debug
debug:
var: file_contents
- name: debug
Which module would you use to send multiple pub keys to authorized_keys?
Copy for one
authorized_keys for multiple
Show an example of how you would send your pub keys without using the copy module
- name: test
hosts: ansible3
tasks:- name: copy auth keys
authorized_key:
user: ansible
state: present
key: “{{ lookup(‘file’, ‘/home/danny/.ssh/id_rsa.pub’) }}”
- name: copy auth keys
Basically this means the user danny on YOUR server will be able to login as ansible on the REMOTE server
Always Use Some Keys
Create two var files with groups to add to a server and users
Add them to the server
Create ssh keys for all the users
page 316
lookup can’t read hidden files so place them somewhere where it can find them
CORRECTION
It can’t read relative paths
Why do you need to move your public keys to use the authorized_keys module?
Because it can’t read hidden files
ssh-keygen and generate-ssh-key have a major difference, what is it?
How do you fix this?
generate_ssh_key doesn’t add username@host which will make the key invalid, you will need to add it personally
- name: keygen
user:
name: nathan
generate_ssh_key: true
ssh_key_comment: controller_user@controller
Create a local use with ssh keys and then allow them to remote to a host
PG 318
What does password: accept in the user module?
only encrypted strings
