Red Hat Security: Linux in Physical, Virtual, and Cloud

Instructions

1. On the workstation machine, install the ansible-navigator RPM package that provides automation content navigator, to use that machine as your control node.

   [student@workstation ~]$ sudo dnf install ansible-navigator
   [sudo] password for student: student
   ...output omitted...
   Is this ok [y/N]: y
   ...output omitted...
   Complete!

2. Ensure that for the ansible-navigator tool, the execution environment container image is downloaded.

   Note

   You do not need to download the ee-supported-rhel9 execution environment, because it is preloaded in your classroom.

   [student@workstation ~]$ ansible-navigator images

     Image                 Tag     Execution environment   Created         Size
   0│ee-supported-rhel9    latest  True                    10 days ago     1.63 GB
   
   
   ^b/PgUp page up   ^f/PgDn page down   ↑↓ scroll   esc back   [0-9] goto   :help

   Press Esc to exit the image list.

3. Create the /home/student/security-ansible directory.

   [student@workstation ~]$ mkdir ~student/security-ansible

4. Navigate to the /home/student/security-ansible directory.

   [student@workstation ~]$ cd ~student/security-ansible
   [student@workstation security-ansible]$

5. In the /home/student/security-ansible directory, create an Ansible configuration file named ansible.cfg. Use the following content and values.

   [student@workstation security-ansible]$ cat ansible.cfg
   [defaults]
   inventory       = ./inventory
   remote_user     = ansible-testuser
   
   [privilege_escalation]
   become          = true
   become_method   = sudo
   become_user     = root
   become_ask_pass = false

6. In the /home/student/security-ansible directory, create the inventory file named inventory. Use the following content.

   [student@workstation security-ansible]$ cat inventory
   [Boston]
   servera
   serverb
   
   [Raleigh]
   workstation
   
   [cities:children]
   Boston
   Raleigh

7. List all the managed hosts that are present in the inventory.

   [student@workstation security-ansible]$ ansible-navigator inventory \
       -m stdout --graph
   @all:
     |--@ungrouped:
     |--@cities:
     |  |--@Boston:
     |  |  |--servera
     |  |  |--serverb
     |  |--@Raleigh:
     |  |  |--workstation

8. In the /home/student/security-ansible directory, create an Ansible Playbook file named sshd_config.yml. Use the following content and values.

   [student@workstation security-ansible]$ cat sshd_config.yml
   ---
   - name: Play to disable SSH password-based authentication
     hosts: Boston
     tasks:
       - name: Task to disable SSH password-based authentication
         ansible.builtin.lineinfile:
           path: /etc/ssh/sshd_config
           regexp: 'PasswordAuthentication yes'
           backrefs: yes
           line: 'PasswordAuthentication no'
       - name: Restart sshd
         ansible.builtin.service:
           name: sshd
           state: restarted
   ...

9. Before running your playbook, validate the sshd_config.yml playbook syntax. Correct any reported errors before continuing.

   [student@workstation security-ansible]$ ansible-navigator run \
       -m stdout sshd_config.yml --syntax-check
   playbook: /home/student/security-ansible/sshd_config.yml

10. Run the sshd_config.yml playbook. Read through the generated output to ensure that all tasks completed successfully.

    [student@workstation security-ansible]$ ansible-navigator run \
        -m stdout sshd_config.yml
    PLAY [Play to disable SSH password-based authentication] ***********************
    
    TASK [Gathering Facts] *********************************************************
    ok: [serverb]
    ok: [servera]
    
    TASK [Task to disable SSH password-based authentication] ***********************
    changed: [serverb]
    changed: [servera]
    
    TASK [Restart sshd] ************************************************************
    changed: [serverb]
    changed: [servera]
    
    PLAY RECAP *********************************************************************
    servera   : ok=2    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
    serverb   : ok=2    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

11. Verify that you cannot log in to the servera or serverb machines from the serverc machine by using password authentication.

    1. Log in to the serverc machine as the student user. No password is required.

       [student@workstation ~]$ ssh student@serverc
       [student@serverc ~]$

    2. Verify that you cannot log in to the servera or serverb machines by using password authentication.

       [student@serverc ~]$ ssh student@servera
       student@servera: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
       [student@serverc ~]$ ssh student@serverb
       student@serverb: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
       [student@serverc ~]$

    3. Return to the workstation machine when done.

       [student@serverc ~]$ logout
       [student@workstation ~]$