Red Hat Security: Linux in Physical, Virtual, and Cloud

Bookmark this page
P123456789101112
PreviousNext

Lab: Automating Configuration and Remediation with Ansible

Performance Checklist

In this lab, you will ensure your workstation is prepared to use Ansible and has been configured with an appropriate configuration file and inventory, and use a provided playbook in order to ensure that several servers are in the correct configuration.

Outcomes

You should be able to:

  • Install and configure Ansible.

  • Confirm that Ansible is working correctly and can connect to managed hosts, using ad hoc commands.

  • Run Ansible Playbooks to configure managed hosts.

Verify that workstation, servera, and serverb are started.

Log in to workstation as student using student as the password. From workstation, run lab ansible-review setup to verify that the environment is ready. 

[student@workstation ~]$ lab ansible-review setup

  1. On workstation, install the ansible package.

    1. On workstation as the student user, install the ansible package administratively using the sudo command. 

      [student@workstation ~]$ sudo yum install ansible
[sudo] password for student: student
...output omitted...
======================================================
 Package      Arch    Version         Repository  Size
======================================================
Installing:
 ansible      noarch  2.5.5-1.el7ae   ansible     9.1M

Transaction Summary
======================================================
Install  1 Package

Total download size: 9.1 M
Installed size: 46 M
Is this ok [y/d/N]: y
...output omitted...
Installed:
  ansible.noarch 0:2.5.5-1.el7ae                                                                                                        

Complete!

  2. On workstation as ansible-testuser, create the /home/ansible-testuser/lab directory. In the lab directory, create an inventory file that defines the webservers host group. This host group includes two managed hosts, servera.lab.example.com, and serverb.lab.example.com. The password of ansible-testuser is redhat.

    1. Switch to the ansible-testuser user. Use redhat as the password. 

      [student@workstation ~]$ su - ansible-testuser
Password: redhat
Last login: Wed Aug  1 07:53:19 IST 2018 on pts/0
[ansible-testuser@workstation ~]$

    2. Create the /home/ansible-testuser/lab directory. 

      [ansible-testuser@workstation ~]$ mkdir ~/lab

    3. Create an inventory file in the lab directory. This inventory file contains the webservers host group which includes two managed hosts, servera.lab.example.com, and serverb.lab.example.com. 

      [ansible-testuser@workstation ~]$ cd ~/lab
[ansible-testuser@workstation lab]$ vi inventory           
[ansible-testuser@workstation lab]$ cat inventory 
[webservers]
servera.lab.example.com 
serverb.lab.example.com

  3. In /home/ansible-testuser/lab, create an Ansible configuration file that uses the inventory file previously created. It should use the ansible-testuser user account to log in to the remote managed hosts. Configure the privilege escalation settings such that it uses sudo to perform tasks as root on the remote managed hosts. Ansible should prompt the user for the sudo password.

    1. In the lab directory, create an Ansible configuration file which uses the inventory file previously created. You need to define the ansible-testuser user as the remote user, and enable Ansible to ask for a password to log in to the managed host. Finally, you need to configure privilege escalation with sudo and root as the remote user, and enable Ansible to ask for a password to become root in the managed host. 

      [ansible-testuser@workstation lab]$ vi ansible.cfg
[ansible-testuser@workstation lab]$ cat ansible.cfg              
[defaults]
inventory = ./inventory
remote_user = ansible-testuser
ask_pass = True

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=True

  4. Use an Ansible ad hoc command to confirm that the two managed hosts in the webservers host group are available. Verify that the httpd package is yet to be installed on either host. Also, confirm that TCP port 80 is blocked by both hosts' firewall settings.

    1. Confirm that the two managed hosts in the webservers host group are available. Use the ping Ansible module. 

      [ansible-testuser@workstation lab]$ ansible webservers -m ping
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
serverb.lab.example.com | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}
servera.lab.example.com | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

    2. Use the command Ansible module to confirm that the httpd package is yet to be installed in the managed hosts of the webservers host group. The following output shows that the httpd packaged is not installed on the managed hosts. 

      [ansible-testuser@workstation lab]$ ansible webservers -m command \
> -a "yum list installed httpd"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
...output omitted...
serverb.lab.example.com | FAILED | rc=1 >>
Loaded plugins: enabled_repos_upload, langpacks, package_upload, product-id,
              : search-disabled-repos, subscription-manager
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-managerError: No matching Packages to listnon-zero return code

servera.lab.example.com | FAILED | rc=1 >>
Loaded plugins: enabled_repos_upload, langpacks, package_upload, product-id,
              : search-disabled-repos, subscription-manager
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-managerError: No matching Packages to listnon-zero return code

      Note

      The ansible webservers -m yum -a "list=httpd" command is an alternative solution that in a number of ways is superior because it uses a purpose-built module instead of depending on command. However, unless you looked in ansible-doc, you might not know about that module.

    3. Ensure that TCP port 80 is blocked by firewalld on the managed hosts in the webservers host group. Use the firewalld Ansible module to check the port and the http service definition, and disable access if it is open.

      The output shows that neither the port nor the service definition was enabled in firewalld on the managed hosts, since no changes were made. 

      [ansible-testuser@workstation lab]$ ansible webservers -m firewalld \
> -a "port=80/tcp state=disabled immediate=true permanent=true"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS => {
    "changed": false, 
    "msg": "Permanent and Non-Permanent(immediate) operation"
}
serverb.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "Permanent and Non-Permanent(immediate) operation"
}
[ansible-testuser@workstation lab]$ ansible webservers -m firewalld \
> -a "service=http state=disabled immediate=true permanent=true"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS => {
    "changed": false, 
    "msg": "Permanent and Non-Permanent(immediate) operation"
}
serverb.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "Permanent and Non-Permanent(immediate) operation"
}

  5. Run the http://materials.example.com/labs/deploy-httpd.yml Ansible Playbook to install, and configure the httpd service on the managed hosts. When done, verify that the httpd package is installed, and that TCP port 80 is open on those managed hosts.

    1. Download the deploy-httpd.yml Ansible Playbook from http://materials.example.com/labs/deploy-httpd.yml. 

      [ansible-testuser@workstation lab]$ wget \
> http://materials.example.com/labs/deploy-httpd.yml
...output omitted...

    2. Run the deploy-httpd.yml playbook to deploy the httpd service, and open TCP port 80 on the managed hosts. 

      [ansible-testuser@workstation lab]$ ansible-playbook deploy-httpd.yml
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
...output omitted...
servera.lab.example.com    : ok=3    changed=1    unreachable=0    failed=0   
serverb.lab.example.com    : ok=3    changed=1    unreachable=0    failed=0
[ansible-testuser@workstation lab]$

    3. Use the command Ansible module to verify that the httpd package is installed on the managed hosts of the webservers host group. The output shows that the httpd package is installed on the managed hosts. 

      [ansible-testuser@workstation lab]$ ansible webservers -m command \
> -a "yum list installed httpd"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
 [WARNING]: Consider using the yum module rather than running yum.  If you need to use command because yum is insufficient you can add
warn=False to this command task or set command_warnings=False in ansible.cfg to get rid of this message.

servera.lab.example.com | SUCCESS | rc=0 >>
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-
              : manager
This system is not registered with an entitlement server.
You can use subscription-manager to register.

Installed Packages
httpd.x86_64      2.4.6-80.el7   @rhel--server-dvd

serverb.lab.example.com | SUCCESS | rc=0 >>
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-
              : manager
This system is not registered with an entitlement server.
You can use subscription-manager to register.

Installed Packages
httpd.x86_64      2.4.6-80.el7   @rhel--server-dvd

      Note

      Again, the ansible webservers -m yum -a "list=httpd" command is an alternative solution that you could also use to determine this.

    4. Verify that TCP port 80 is open in the firewall settings of the managed hosts of the webservers host group with the command Ansible module. The output shows that 80/TCP is open in the firewall settings of the managed hosts. 

      [ansible-testuser@workstation lab]$ ansible webservers -m command \
> -a "firewall-cmd --list-ports --zone=public"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS | rc=0 >>
80/tcp

serverb.lab.example.com | SUCCESS | rc=0 >>
80/tcp

      Note

      You could simply run an ad hoc command with the firewalld module to check the configuration and correct it automatically if it was incorrect. However, this approach might more clearly show you that the port is already configured on both hosts due to the playbook, without disturbing the systems' current configuration.

    5. Log out as ansible-testuser from workstation. 

      [ansible-testuser@workstation lab]$ logout
[student@workstation ~]$

  6. Navigate in a web browser to http://servera.lab.example.com and http://serverb.lab.example.com to verify the configuration.

    1. On workstation, open Firefox, and navigate to http://servera.lab.example.com. Verify that the default Apache homepage shows.

    2. Navigate to http://serverb.lab.example.com. Verify that the default Apache homepage shows.

Evaluation

On workstation, run the lab ansible-review grade command to confirm success of this exercise. 

[student@workstation ~]$ lab ansible-review grade

Cleanup

On workstation, run the lab ansible-review cleanup script to clean up this exercise. 

[student@workstation ~]$ lab ansible-review cleanup

This concludes the lab.

PreviousNext
Revision: rh415-7.5-813735c