ANSIBLE: PREPARING THE ​MANAGED NODE FOR ANSIBLE WITH ANSIBLE

If you are new to ansible I would recommend reading my previous article Ansible: Getting Started

Ansible is agent less and works on SSH to manage and automate tasks on Linux nodes. We would also like this automation to be un-attended. To achieve this,  managed nodes need to be prepared using the below process...

• Create a non root user, for example devops
• Adds SSH authorized keys for devops user account from control node so that we have password less authentication
• Add this user to sudoers with NOPASSWD so that whenever privilege escalation is required we can achieve that without prompting for password.

All this can be done with a simple ansible playbook

ansible.cfg

Default ansible configuration file is located at /etc/ansible/ansible.cfg. Verify your by running ansible --version command

Disable strict host checking in ansible.cfg file. Make sure the below line is present under [ssh_connection] section

ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no

Inventory

Add the required host IP Address or hostname in your ansible inventory file.

Playbook

- name: Initial Setup
  vars_prompt:
    - name: "ansible_ssh_pass"
      prompt: "root password for remote connection?"
      private: yes
  hosts: all
  tasks:
    - name: Create DevOps User
      user:
        name: devops
        state: present
    - name: Add devops to sudoers
      lineinfile:
        path: /etc/sudoers.d/devops
        line: "devops        ALL=(ALL)       NOPASSWD: ALL"
        state: present
        create: true
    - name: Set authorized key
      authorized_key:
        user: devops
        state: present
        key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

• Using vars_prompt user will be prompted to type password for root user of managed node. ansible_ssh_pass  is the ssh password that will be used to login to remote node.
• TASK1: Creates devops user using user module
• TASK2: Add devops user to sudoer file using lineinfile module
• TASK3: Adds SSH authorized keys for devops user accounts using authorized_key module

Lets Execute

[root@centos ~]# ansible-playbook setup.yml
root password for remote connection?: 


PLAY [Initial Setup] ****************************************************************************

TASK [Gathering Facts] ****************************************************************************
ok: [192.168.56.101]

TASK [Create DevOps User] ****************************************************************************
changed: [192.168.56.101]

TASK [Add devops to sudoers] ****************************************************************************
changed: [192.168.56.101]

TASK [Set authorized key] ****************************************************************************
changed: [192.168.56.101]

PLAY RECAP ****************************************************************************
192.168.56.101             : ok=4    changed=3    unreachable=0    failed=0  

Lets Test it

If the playbook is runs successfully, we should be able to connect to our managed nodes with ansible using devops user and also gain privilege escalation using --become option. This can be tested with ping module

[root@centos ~]# ansible all -m ping -u devops
192.168.56.101 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}
[root@centos ~]# ansible all -m ping -u devops --become
192.168.56.101 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}
[root@centos ~]# 

— Enjoy :)

Like it? Click here to Tweet your feedback