Red Hat Security: Linux in Physical, Virtual, and Cloud

Objectives

After completing this section, students should be able to run playbooks and manage access to authentication credentials using Red Hat Ansible Tower.

Red Hat Ansible Tower and Security Management

Managing Ansible for IT automation at scale across an enterprise can present some challenges. You can have multiple administrators use the same Ansible Playbooks, but Ansible itself does not provide a facility to help you ensure that they have the latest version of the playbook, or who is running what playbook from where. It also does not provide a way for you to easily allow administrators to run Ansible Playbooks but limit them from needing to know the administrative credentials for your hosts.

Red Hat Ansible Tower is an additional service that you can run on-site to address these issues. It provides a way for you to centrally control and manage Ansible in your IT infrastructure, with a web-based user interface and visual dashboard, role-based access control, job scheduling, logging, integrated notifications and graphical inventory management. It also provides a REST API that you can use to integrate Ansible into your existing tools and processes. It can help you scale automation with Ansible, manage complex deployments, and speed productivity.

From a security perspective, Red Hat Ansible Tower helps you control, secure, and manage your Ansible automation at scale. You can use it to control who has access to run particular playbooks and which inventories they can use or manage. You can allow users of the Ansible Tower server to use machine credentials and control who can manage them, without allowing users to transfer them or see their contents. It logs who ran what Ansible jobs on what hosts when, and what the results of those jobs were. It provides a way for you to centrally manage your Ansible inventories, to make sure no hosts are missed.

Users typically interact with Red Hat Ansible Tower through the server's web-based user interface or by using its REST API. The server's web-based user interface performs its actions by executing calls against the server's API. Therefore, any action that you can perform through the web-based interface can also be performed by directly using the server's API.

The following diagram illustrates the architecture of Red Hat Ansible Tower.

Figure 2.1: Ansible Tower architecture

Operating Red Hat Ansible Tower

To better understand how Red Hat Ansible Tower can help you manage credentials, to run Ansible Playbooks, and to log the results of those runs, you need to understand the basics of how it it works. The following is a quick overview of how to use the Ansible Tower web-based user interface to launch a job with an example Ansible playbook, an inventory, and some access credentials for the machines in the inventory.

The basic idea is that you start playbook runs by "launching" a job from a job template. You configure Ansible Tower with a number of projects that can access playbooks. You also configure Tower with a number of inventories and the necessary machine credentials to log in to inventory hosts and escalate privileges. The job template is set up by an administrator. It specifies which playbook from which project should be run on the hosts in a particular inventory using particular machine credentials when you use the job template to launch a job.

Navigating the Ansible Tower Web Interface

When you log in to Ansible Tower, you are presented with a dashboard providing summary information about recent activity on the server and navigational links to configure resources and launch jobs.

Across the top of the interface, on the left side, are quick links to configure projects, inventories, job templates, and to the logs of the jobs that have been run.

Figure 2.2: Quick navigation links

On the right side are quick links to access your user account, the Settings interface for users and credentials, documentation, and to log out of Ansible Tower.

Figure 2.3: Administrative tool links

The dashboard itself presents four sections:

Figure 2.4: Ansible Tower dashboard

Launching a Job from a Job Template

A job template can be used to launch jobs (run playbooks) repeatedly using the same parameters. A job template is somewhat like a prepared ansible-playbook command complete with options and arguments that you can run at the click of a button.

This is an example of how to launch a job from a job template, using the Demo Job Template included with Ansible Tower.

Controlling User Access in Ansible Tower

Different people using an Ansible Tower installation need to have different levels of access. Some may simply need to run existing job templates against a preconfigured inventory of machines. Others need to be able to modify particular inventories, job templates, and playbooks. Still others may need access to change anything in the Tower installation.

Ansible Tower has a built-in administrative user, admin, that has superuser access to the entire Tower configuration. In order to make it easier to manage individual access to inventories, credentials, projects, and job templates, user accounts can be set up for each person who uses the Tower installation.

As an administrator, you assign roles to users that grant permissions which define whether they can can use, see, change, or delete an object in Ansible Tower. For example, you might grant a user roles that allow them to use a job template with a machine credential to run a playbook, but not to change that template or credential. Roles can also be managed collectively by granting them to a team, which is a collection of users. All users in the team inherit the team's roles.

For very large deployments, it can be helpful to categorize users, teams, projects, and inventories into different departments. An organization is a logical collection of users, teams, projects, and inventories. All users must belong to an organization, and as part of installation a Default organization is created.

Managing Access to Machine Credentials

Credentials are Ansible Tower objects that are used to authenticate to remote systems for various purposes. They may provide secrets such as passwords, SSH keys, or other supporting information needed to successfully access or use a remote resource.

Ansible Tower is responsible for maintaining secure storage for the secrets in these credential objects. Credential passwords and keys are encrypted before they are saved to the Tower database, and can not be retrieved in clear text from the Tower user interface. Users and teams can be assigned privileges to use credentials, but the secrets are not exposed to them. When a credential is needed by Tower, it decrypts the data internally and passes it to Ansible directly.

Ansible Tower has a number of different types of credentials that it can manage, including:

Credentials are managed in the Ansible Tower dashboard by clicking the gear icon to access the Settings page, and then selecting CREDENTIALS.

Users can be assigned the following roles to control their access to a credential:

Protecting credentials and privilege escalation settings in the Red Hat Ansible Tower server is vital to prevent unauthorized changes or access to the systems it manages. You should limit most users that need to use the credential to use access, and not grant access at all unless a user should have it.

To check the roles users have on a credential, login to the dashboard as admin and select the gear icon to navigate to Settings. Click on CREDENTIALS and select the credential.

In the following example, the admin user has administrative rights on the credential but demo-user1 only has use.

Figure 2.8: An Ansible Tower machine credential's roles

Managing Static Inventories in Ansible Tower

Inventories are also configured as Ansible Tower objects. To create an empty inventory, click the INVENTORIES quick navigation link at the top of the Ansible Tower web interface, and then on the Inventories screen, click ADD. On the NEW INVENTORY screen, enter a name for your inventory and assign it to an organization, then click SAVE.

To add individual hosts to the inventory, click on the inventory name to open its detail screen, and then click ADD HOST. Enter the host name of the host to add, then click SAVE. You can also use the web interface to add host groups and to statically add hosts to those host groups.

To control access to an inventory, as an administrator you assign roles on it to users. These roles include:

Creating a Job Template

Without spending a great deal of time covering the topic, this is a high-level overview of the process you would use to create a job template in Red Hat Ansible Tower.