Red Hat Security: Linux in Physical, Virtual, and Cloud

Bookmark this page
P123456789101112
PreviousNext

Lab: Automating Configuration and Remediation with Ansible

In this review, you will ensure your workstation is prepared to use Ansible and has been configured with an appropriate configuration file and inventory, and use a provided playbook to ensure that several servers are in the correct configuration.

Outcomes

You should be able to:

  • Install and configure Ansible.

  • Verify the configuration of managed hosts with Ansible ad hoc commands.

  • Run Ansible Playbooks.

Warning

Before starting the following exercises, you must reset your virtual machines. This will destroy any data stored on those machines from previous exercises.

If you want to keep any data from the lab environment, save it before resetting your machines.

You must reset all machines in the lab environment for the following exercises to work as expected.

Set up your computers for this exercise by logging in to workstation as student, and run the following command: 

[student@workstation ~]$ lab ansible-cr setup

Instructions

As the devops user on workstation, use the existing in the /home/devops/cr-lab1 directory Ansible Playbook to configure your web servers based on the following instructions.

  • On workstation, install the ansible package. Confirm that the ansible command is available.

  • In the existing /home/devops/cr-lab1 directory, create an Ansible inventory file that defines the http host group. This host group should include two managed hosts, servera.lab.example.com and serverb.lab.example.com.

  • You should also create an Ansible configuration file in the /home/devops/cr-lab1 directory. It should set the inventory file to use the one you created in that directory. It should configure Ansible to log in as the devops user on remote managed hosts. It should enable privilege escalation using sudo and prompt the user for their ssh and sudo passwords.

  • In that directory, use an Ansible ad hoc command to confirm that you can use Ansible to manage the two managed hosts in the http host group.

  • Before running the playbook, use Ansible ad hoc commands to ensure that the httpd package is not installed, and that TCP port 80 is blocked by firewalld on those managed hosts.

  • Run the http://materials.example.com/ansible/cr-httpd.yml Ansible Playbook to install and configure the httpd service on the managed hosts.

  • Open Firefox and navigate to http://servera.lab.example.com and http://serverb.lab.example.com to confirm that the web servers are available.

  1. On workstation, install the ansible package.

    1. On workstation as the student, install the ansible package with the sudo command. 

      [student@workstation ~]$ sudo yum -y install ansible
[sudo] password for student: student
...output omitted...
Installed:
  ansible.noarch 0:2.5.5-1.el7ae

Complete!

  2. As the devops user on workstation, create an Ansible inventory file in the existing /home/devops/cr-lab1 directory. It should define the http host group, which should consist of two managed hosts, servera.lab.example.com and serverb.lab.example.com.

    1. Switch to the devops user. Use redhat as the password. 

      [student@workstation ~]$ su - devops
Password: redhat
Last login: Wed Aug  1 07:53:19 IST 2018 on pts/0
[devops@workstation ~]$

    2. Change your working directory to /home/devops/cr-lab1. 

      [devops@workstation ~]$ cd ~/cr-lab1

    3. Create an inventory file in the cr-lab1 directory. This inventory file should define the http host group, which should consist of two managed hosts, servera.lab.example.com and serverb.lab.example.com. 

      [devops@workstation cr-lab1]$ vi inventory
[http]
servera.lab.example.com
serverb.lab.example.com

  3. Create an Ansible configuration file that uses the inventory file previously created, and log in to the remote managed hosts as the devops user.

    1. In the cr-lab1 directory, create an Ansible configuration file. It should set the inventory file to the one you just created. It should configure Ansible to log in as the devops user on remote managed hosts. It should enable privilege escalation using sudo and prompt for the remote user's SSH and sudo passwords. 

      [devops@workstation cr-lab1]$ vi ansible.cfg
[defaults]
inventory = ./inventory
remote_user = devops
ask_pass = True

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=True

  4. Use an Ansible ad hoc command to confirm that you can use Ansible to manage the two managed hosts in the http host group. Use additional ad hoc commands to ensure that neither host has the httpd package installed, and that TCP port 80 is blocked by firewalld on those managed hosts.

    1. Confirm that you can connect to the two managed hosts in the http host group with Ansible. Use the ping Ansible module in an ad hoc command.

      Note

      If you get an error connecting to the managed hosts due to the SSH host key not being known to workstation, you can work around this by using ssh to connect to each system once and then accepting the unknown host key presented. For this to work you must use the Fully Qualified Domain Names for all the hosts, for example: servera.lab.example.com. Then you can try this ad hoc command a second time and it should work. 

      [devops@workstation cr-lab1]$ ansible http -m ping
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
serverb.lab.example.com | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

    2. Use the yum Ansible module in an ad hoc command to ensure that the httpd package is not installed on the managed hosts of the http host group. 

      [devops@workstation cr-lab1]$ ansible http -m yum \
> -a "name=httpd state=absent"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "",
    "rc": 0,
    "results": [
        "httpd is not installed"
    ]
}
serverb.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "",
    "rc": 0,
    "results": [
        "httpd is not installed"
    ]
}

    3. Use the firewalld Ansible module in an ad hoc command to ensure that TCP port 80 is blocked on the managed hosts of the http host group. 

      [devops@workstation cr-lab1]$ ansible http -m firewalld \
> -a "port=80/tcp state=disabled immediate=true permanent=true"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "Permanent and Non-Permanent(immediate) operation"
}
serverb.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "Permanent and Non-Permanent(immediate) operation"
}
[ansible-testuser@workstation lab]$ ansible http -m firewalld \
> -a "service=http state=disabled immediate=true permanent=true"
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
servera.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "Permanent and Non-Permanent(immediate) operation"
}
serverb.lab.example.com | SUCCESS => {
    "changed": false,
    "msg": "Permanent and Non-Permanent(immediate) operation"
}

  5. Download the Ansible Playbook at http://materials.example.com/labs/cr-httpd.yml to your /home/devops/cr-lab1 directory on workstation. Run it to install and configure the httpd service on your managed hosts.

    1. Download the cr-httpd.yml Ansible Playbook from http://materials.example.com/ansible/cr-httpd.yml. 

      [devops@workstation cr-lab1]$ wget \
> http://materials.example.com/ansible/cr-httpd.yml
...output omitted...

    2. Run the cr-httpd.yml playbook to deploy the httpd service and open TCP port 80 on your managed hosts. 

      [devops@workstation cr-lab1]$ ansible-playbook cr-httpd.yml
SSH password: redhat
SUDO password[defaults to SSH password]: redhat
...output omitted...
servera.lab.example.com    : ok=8    changed=7    unreachable=0    failed=0
serverb.lab.example.com    : ok=8    changed=7    unreachable=0    failed=0

  6. Open Firefox and navigate to http://servera.lab.example.com and http://serverb.lab.example.com to confirm that the web server on each system is running and serving content.

    1. Use the curl command and navigate http://servera.lab.example.com. Verify that a new page is displayed. 

      [devops@workstation cr-lab1]$ curl http://servera.lab.example.com
This is a test message RedHat 7.5 <br>
Current Host: servera <br>
Server list: <br>
servera.lab.example.com <br>
serverb.lab.example.com <br>
Deployment Version: 1<br>

    2. Navigate to http://serverb.lab.example.com. Verify that a new page is displayed. 

      [devops@workstation cr-lab1]$ curl http://serverb.lab.example.com
This is a test message RedHat 7.5 <br>
Current Host: serverb <br>
Server list: <br>
servera.lab.example.com <br>
serverb.lab.example.com <br>
Deployment Version: 1<br>
[devops@workstation cr-lab1]$ logout
[student@workstation ~]$

Evaluation

As the student user on workstation, run the lab ansible-cr script with the grade argument to confirm success on this exercise. Correct any reported failures and rerun the script until successful. 

[student@workstation ~]$ lab ansible-cr grade
PreviousNext
Revision: rh415-7.5-813735c