Red Hat Enterprise Linux Automation with Ansible

Procedure 3.2. Instructions

1. Change into the /home/student/data-secret directory.

   [student@workstation ~]$ cd ~/data-secret
   [student@workstation data-secret]$

2. Edit the contents of the encrypted secret.yml file. The file can be decrypted using redhat as the password. Uncomment the username and pwhash variable entries.

   1. Edit the encrypted /home/student/data-secret/secret.yml file. Enter redhat as the Vault password when prompted. The encrypted file opens in the default editor, vim.

      [student@workstation data-secret]$ ansible-vault edit secret.yml
      Vault password: redhat

   2. Uncomment the two variable entries (username and pwhash) by removing the pound sign (#) at the start of each line, and then save and close the file.

3. Create a playbook named /home/student/data-secret/create_users.yml. The playbook should contain one play (create user accounts for all our servers in the following example), which uses the variables defined in the /home/student/data-secret/secret.yml encrypted file.

   Configure the play to use the devservers host group. Run this play as the devops user on the remote managed host. Configure the play to create the ansibleuser1 user defined by the username variable. Set the user's password using the password hash stored in the pwhash variable.

   ---
   - name: create user accounts for all our servers
     hosts: devservers
     become: True
     remote_user: devops
     vars_files:
       - secret.yml
     tasks:
       - name: Creating user from secret.yml
         ansible.builtin.user:
           name: "{{ username }}"
           password: "{{ pwhash }}"

4. Verify the syntax of your create_users.yml playbook by running the ansible-navigator run -m stdout --syntax-check command.

   Use the --vault-id @prompt option so that it interactively prompts you for the Vault password that decrypts the secret.yml file. Resolve any syntax errors in your playbook before you continue.

   [student@workstation data-secret]$ ansible-navigator run -m stdout \
   > --playbook-artifact-enable false create_users.yml \
   > --syntax-check --vault-id @prompt
   Vault password (default): redhat
   
   playbook: /home/student/data-secret/create_users.yml

5. Create a password file named vault-pass that contains the password for ansible-navigator to use instead of prompting you for a password when it runs the create_users.yml playbook. The file must contain the plain text redhat as the Vault password. Change the permissions of the file to 0600.

   [student@workstation data-secret]$ echo 'redhat' > vault-pass
   [student@workstation data-secret]$ chmod 0600 vault-pass

6. Run the Ansible Playbook to create the ansibleuser1 user on a remote system, using the Vault password in the vault-pass file to decrypt the hashed password for that user. That password is stored as a variable in the secret.yml Ansible Vault encrypted file.

   [student@workstation data-secret]$ ansible-navigator run \
   > -m stdout create_users.yml --vault-password-file=vault-pass
   
   PLAY [create user accounts for all our servers] ********************************
   
   TASK [Gathering Facts] *********************************************************
   ok: [servera.lab.example.com]
   
   TASK [Creating users from secret.yml] ******************************************
   changed: [servera.lab.example.com]
   
   PLAY RECAP *********************************************************************
   servera.lab.example.com    : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

7. Verify that the playbook ran correctly. The ansibleuser1 user should exist and have the correct password on the servera.lab.example.com machine.

   Test this by using ssh to log in to the servera.lab.example.com machine as the ansibleuser1 user with redhat as the password.

   To make sure that SSH only tries to authenticate by password and not by using an SSH key, use the -o PreferredAuthentications=password option when you log in.

   Log off from servera when you have successfully logged in.

   [student@workstation data-secret]$ ssh -o PreferredAuthentications=password \
   > ansibleuser1@servera.lab.example.com
   ansibleuser1@servera.lab.example.com's password: redhat
   ...output omitted...
   [ansibleuser1@servera ~]$ exit
   logout
   Connection to servera.lab.example.com closed.