Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
In this exercise, you will be provided with an Ansible Playbook in order to examine and determine what it does, and which you will then run against multiple hosts using your inventory file.
Outcomes
You should be able to:
Evaluate an Ansible playbook having multiple tasks to accomplish a certain procedure.
Run the playbook on one or more systems.
Review the output of a playbook run.
Examine those systems manually to observe the changes.
Run the playbook again to confirm that no further changes are applied.
Confirm that workstation, servera and serverb machines are started.
Log in to the workstation machine as the student user with student as the password. From the workstation, run the lab ansible-remediate setup command to prepare the classroom environment for the guided exercise. This command:
Uninstalls the ansible from the
workstationmachineCreates the
ansible-testuseruserGenerates the SSH key-pair for the
ansible-testuseruser on theworkstationmachineExports the public key of the SSH key-pair to the same user of the
serveraand theserverbmachinesVerifies the public key-based authentication from the
workstationhost to theserveraandserverbhostsConfigures the sudo privileges for the
ansible-testuseron theworkstation,serveraandserverbmachinesDownloads the lab files that include a custom web page and the pre-created Ansible playbook and saves it under the home directory of the
ansible-testuseruserVerifies the installed version of the python package on the
workstation,serveraandserverbmachines
[student@workstation ~]$lab ansible-remediate setup
Switch to the
ansible-testuserusingredhatas the password.[student@workstation ~]$su - ansible-testuserPassword:redhatLast login: Wed Aug 1 07:53:19 IST 2018 on pts/0[ansible-testuser@workstation ~]$Navigate to the
~ansible-testuser/ansible-remediate/directory.[ansible-testuser@workstation ~]$cd ansible-remediate[ansible-testuser@workstation ansible-remediate]Update the existing
webservers.ymlfile to mention that the playbook applies to the hosts in theSERVERSgroup as defined in the inventory. Also, specifyansible-testuseras the remote user to use while executing the tasks from the given playbook.[ansible-testuser@workstation ansible-remediate]$vi webservers.yml[ansible-testuser@workstation ansible-remediate]$cat webservers.yml--- - name: installs, configures and starts apache hosts:SERVERSremote_user:ansible-testuser...output omitted...Verify the
packagemodule and its parameters inwebservers.ymlfile that installs Apache httpd package as part of the task.[ansible-testuser@workstation ansible-remediate]$cat webservers.yml...output omitted... tasks: - name: installs apache package package: name: httpd state: present ...output omitted...Notice the name of the task that appears as
installs apache package. The following line to that mentions the module name aspackageto install the httpd utility. Thenameattribute as defined under thepackageline specifies the package httpd. Thestateattribute set topresenttriggers an installation of the httpd package if it is not already installed.Verify the
lineinfilemodule and its parameters inwebservers.ymlfile that modifies the configuration file of Apachehttpdservice to usecustom.htmlas theDirectoryIndexof the Apache web server rather than the defaultindex.html.[ansible-testuser@workstation ansible-remediate]$cat webservers.yml...output omitted... tasks: ...output omitted... - name: configures apache to use custom.html as the DirectoryIndex lineinfile: path: /etc/httpd/conf/httpd.conf regexp: 'DirectoryIndex index.html' backrefs: yes line: 'DirectoryIndex custom.html' notify: - restart apache ...output omitted...Notice the name of the task that appears as
configures Apache to use custom.html as the DirectoryIndex. The following line to that mentions the module name aslineinfileto replace an existing line in the configuration file of thehttpdservice. Thepathattribute as defined under thelineinfileline specifies the configuration file of thehttpdservice to modify. Theregexpattribute searches for the line that appears asDirectoryIndex index.html. Thebackrefsattribute, set toyes, causes thelineinfilemodule to avoid appending the replacement line in case it does not find any occurrence of the search target. This is the default behavior of the module. Thelineattribute specifies the replacement line to overwrite the line being searched for. Thenotifyline calls another handler task to only restart thehttpdservice if there is a change in the configuration of filehttpdservice.Verify that the
firewalldmodule and its parameters inwebservers.ymlfile that opens the80/tcpport so that the Apache web service is accessible from the network.[ansible-testuser@workstation ansible-remediate]$cat webservers.yml...output omitted... tasks: ...output omitted... - name: opens TCP port 80 in firewall firewalld: port: 80/tcp state: enabled permanent: true immediate: yes ...output omitted...Notice the name of the task that appears as
opens TCP port 80 in firewall. The following line to that mentions the module name asfirewalldto adjust the firewall settings on the system. Theportattribute as defined under thefirewalldline specifies the TCP port80, the default port of web services. Thestateattribute, set toenabled, causesfirewalldto allow any HTTP connection request to80/tcpport. Thepermanentattribute, set totrue, saves the firewall settings to persist across reboot. Theimmediateattribute, set toyes, causes the firewall settings to come to effect immediately.Verify the
copymodule and its parameters inwebservers.ymlfile that implements the custom web content.[ansible-testuser@workstation ansible-remediate]$cat webservers.yml...output omitted... tasks: ...output omitted... - name: copies custom web content copy: src: files/custom.html dest: /var/www/html/custom.html ...output omitted...Notice the name of the task that appears as
copies custom web content. The following line to that mentions the module name ascopyto implement the custom web content. Thesrcattribute as defined under thecopyline specifies the file (files/custom.html) that has the custom web content. This file gets into the default document root (/var/www/html) of thehttpdservice as specified against thedestattribute.Verify the
servicemodule and its parameters inwebservers.ymlfile that restarts thehttpdservice to reload the changes from the configuration file of the Apache web service.[ansible-testuser@workstation ansible-remediate]$cat webservers.yml...output omitted... tasks: ...output omitted... - name: starts apache service: name: httpd state: started enabled: true ...output omitted...Notice the name of the task that appears as
starts apache. The following line to that mentions the module name asserviceto start, stop, or restart thehttpdservice. Thenameattribute as defined under theserviceline specifies the service (httpd) that the task targets to start, stop, or restart. Thestateattribute, set tostarted, causes to thehttpdservice to be running. Theenabledattribute, set to true, causes thehttpdservice to persistently run across reboot.Run the Ansible playbook
webservers.yml.[ansible-testuser@workstation ansible-remediate]$ansible-playbook \>webservers.ymlPLAY [installs, configures and starts apache] ******************************** TASK [Gathering Facts] ******************************************************* dhatok: [serverb] ok: [servera] TASK [installs apache package] *********************************************** changed: [servera] changed: [serverb] TASK [configures apache to use custom.html as the DirectoryIndex]************* changed: [servera] changed: [serverb] TASK [opens TCP port 80 in firewall] ***************************************** changed: [serverb] changed: [servera] TASK [copies custom web content] ********************************************* changed: [servera] changed: [serverb] TASK [ensure apache is running] ********************************************** changed: [servera] changed: [serverb] RUNNING HANDLER [restart apache] ********************************************* changed: [servera] changed: [serverb] PLAY RECAP ******************************************************************* servera : ok=7 changed=6 unreachable=0 failed=0 serverb : ok=7 changed=6 unreachable=0 failed=0Execute the playbook again as a repetition of the last step and notice that the play is successful without making any change in the system state as the systems are already in the desired end state.
[ansible-testuser@workstation ansible-remediate]$ansible-playbook \>webservers.yml...output omitted.. PLAY RECAP ****************************************** servera : ok=6 changed=0 unreachable=0 failed=0 serverb : ok=6 changed=0 unreachable=0 failed=0As you may notice from the command output, the value of
okis6indicating that six tasks are executed without any error, the value ofchangedis0which means no change is made in the system.Access the web content to confirm that the playbook
webservers.ymlhas successfully configured both theservera.lab.example.comandserverb.lab.example.comsystems.[ansible-testuser@workstation ansible-remediate]$curl \>http://servera.lab.example.comCustom content for Ansible remediation guided exercise.[ansible-testuser@workstation ansible-remediate]$curl \>http://serverb.lab.example.comCustom content for Ansible remediation guided exercise.Remove the
/var/www/html/custom.htmlfile from bothservera.lab.example.comandserverb.lab.example.comsystems. Confirm that you are seeing the default Apache test page instead of the custom web content.[ansible-testuser@workstation ansible-remediate]$ssh \>ansible-testuser@servera 'sudo rm -f /var/www/html/custom.html'[ansible-testuser@workstation ansible-remediate]$ssh \>ansible-testuser@serverb 'sudo rm -f /var/www/html/custom.html'[ansible-testuser@workstation ansible-remediate]$curl \>http://servera.lab.example.com...output omitted...[ansible-testuser@workstation ansible-remediate]$curl \>http://servera.lab.example.com...output omitted...Notice the default Apache web page which is being displayed. This is not the custom web content.
Run the Ansible playbook
webservers.ymlto remediate this deviation. Confirm that you are able to access the custom web content rather than the default Apache test page. Notice the change in the system state to restore the web content back to the systems. This is the only change in the state of theserveraandserverbsystems.[ansible-testuser@workstation ansible-remediate]$ansible-playbook \>webservers.yml...output omitted... PLAY RECAP ***************************************** servera : ok=6 changed=1 unreachable=0 failed=0 serverb : ok=6 changed=1 unreachable=0 failed=0[ansible-testuser@workstation ansible-remediate]$curl \>http://servera.lab.example.comCustom content for Ansible remediation guided exercise.[ansible-testuser@workstation ansible-remediate]$curl \>http://serverb.lab.example.comCustom content for Ansible remediation guided exercise.[ansible-testuser@workstation ansible-remediate]$logout[student@workstation ~]$
