Red Hat Security: Linux in Physical, Virtual, and Cloud

On the workstation machine, which is your control node, install the ansible package. If you are prompted for the password of the student user, use student.

[student@workstation ~]$ sudo yum install ansible
[sudo] password for student: student
...output omitted...
===========================================================
 Package            Arch    Version        Repository  Size
===========================================================
Installing:
 ansible            noarch  2.5.5-1.el7ae  ansible    9.1 M

Transaction Summary
===========================================================
Install  1 Package

Total download size: 9.1 M
Installed size: 46 M
Is this ok [y/d/N]: y
...output omitted...
Installed:
  ansible.noarch 0:2.5.5-1.el7ae                                                                                                        

Complete!

Switch to the ansible-testuser user using redhat as the password.

[student@workstation ~]$ su - ansible-testuser
Password: redhat
[ansible-testuser@workstation ~]$ 

Create the /home/ansible-testuser/security-ansible directory.

[ansible-testuser@workstation ~]$ mkdir ~ansible-testuser/security-ansible

Navigate to the /home/ansible-testuser/security-ansible directory.

[ansible-testuser@workstation ~]$ cd ~ansible-testuser/security-ansible
[ansible-testuser@workstation security-ansible]$ 

In the /home/ansible-testuser/security-ansible directory, create an Ansible configuration file named ansible.cfg.

Edit it so that Ansible commands run in this directory use /home/ansible-testuser/security-ansible/inventory as the inventory file, ansible-testuser as the remote user to connect to on the managed hosts, and prompt for the SSH password of the remote user (assumed to be the same on all managed hosts).

[ansible-testuser@workstation security-ansible]$ vi ansible.cfg
[ansible-testuser@workstation security-ansible]$ cat ansible.cfg
[defaults]
inventory       = ./inventory
remote_user     = ansible-testuser
ask_pass        = True

Continue to edit /home/ansible-testuser/security-ansible/ansible.cfg. Configure Ansible to automatically use sudo to switch the remote user (ansible-testuser) to the remote root user. Have Ansible prompt you for the remote user's sudo password when you run it.

[ansible-testuser@workstation security-ansible]$ vi ansible.cfg
[ansible-testuser@workstation security-ansible]$ cat ansible.cfg
...output omitted...
[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=True

Create the inventory file /home/ansible-testuser/security-ansible/inventory to group the servera and serverb nodes into the SERVERS group. Also, create a group LOCAL to include the localhost (workstation) into it. Additionally, create a group EVERYONE to include all of the nodes from the defined SERVERS and LOCAL groups.

[ansible-testuser@workstation security-ansible]$ vi inventory
[ansible-testuser@workstation security-ansible]$ cat inventory
[LOCAL]
workstation

[SERVERS]
servera
serverb

[EVERYONE:children]
LOCAL
SERVERS

Verify the inventory settings, as configured in the last step using the --list-hosts option with the ansible command.

[ansible-testuser@workstation security-ansible]$ ansible EVERYONE \
> --list-hosts
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
  hosts (3):
    serverb
    servera.
    workstation

Use the Ansible ping module to verify that you can run Ansible tasks on the managed nodes servera and serverb.

[ansible-testuser@workstation security-ansible]$ ansible SERVERS \
> -m ping
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}
serverb | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

The next command is an example of a sophisticated ad hoc command. It uses the authorized_key module to make sure the local SSH public key belonging to ansible-testuser is in the ~/.ssh/authorized_keys file for ansible-testuser on all hosts in group EVERYONE.

This ensures that ansible-testuser can log in from workstation to the ansible-testuser account on any of the hosts in that host group with SSH public key authentication.

[ansible-testuser@workstation security-ansible]$ ansible EVERYONE \
> -m authorized_key \
> -a "user=ansible-testuser state=present \
> key={{ lookup('file', '/home/ansible-testuser/.ssh/id_rsa.pub') }}"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
...output omitted...

The Ansible lineinfile module checks to see if a line exists in a file or not. It can be used to ensure that line exists, or remove it if it exists.

The next example command uses the Ansible lineinfile module to adjust the settings in the /etc/ssh/sshd_config file on managed hosts in group EVERYONE. It ensures that the directive PasswordAuthentication no is set to disable password-based authentication to SSH on those hosts.

[ansible-testuser@workstation security-ansible]$ ansible EVERYONE \
> -m lineinfile \
> -a "path=/etc/ssh/sshd_config \
> regexp='PasswordAuthentication yes' \
> backrefs=yes line='PasswordAuthentication no'"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
workstation | SUCCESS => {
    "backup": "", 
    "changed": true, 
    "msg": "line replaced"
}
servera | SUCCESS => {
    "backup": "", 
    "changed": true, 
    "msg": "line replaced"
}
serverb | SUCCESS => {
    "backup": "", 
    "changed": true, 
    "msg": "line replaced"
}

Try logging in from the workstation machine to the servera and serverb machines using the public key-based authentication system of SSH explicitly. This should succeed.

[ansible-testuser@workstation security-ansible]$ ssh \
> -o PasswordAuthentication=no \
> -o PubkeyAuthentication=yes \
> ansible-testuser@servera
Last login: Wed Aug  1 09:24:40 2018 from workstation.lab.example.com
[ansible-testuser@servera ~]$ logout
Connection to servera closed.
[ansible-testuser@workstation security-ansible]$ ssh \
> -o PasswordAuthentication=no \
> -o PubkeyAuthentication=yes \
> ansible-testuser@serverb
Last login: Wed Aug  1 09:24:45 2018 from workstation.lab.example.com
[ansible-testuser@serverb ~]$ logout
Connection to serverb closed.
[ansible-testuser@workstation security-ansible]$ logout
[student@workstation ~]$