Category Archives: Linux

All posts around Linux.

Ansible EX294 practice exam and solutions

Task 1 – Ansible installation and configuration

Remember that the default location for the original ansible.cfg is /etc/ansible/ansible.cfg, which you can copy over to your local folder (in this case it’s /home/automation/plays/).

ansible.cfg

These are the fields that I’ve changed in my own ansible.cfg file:

inventory      = /home/automation/plays/inventory
forks          = 10
roles_path    = /home/automation/plays/roles/
host_key_checking = False
remote_user = automation
become=False

inventory = /home/automation/plays/inventory

forks = 10

roles_path = /home/automation/plays/roles/

host_key_checking = False

remote_user = automation

become=False

inventory

[proxy]
node1           ansible_host=ip.of.the.host

[webserver]
node2           ansible_host=ip.of.the.host

[database]
node3           ansible_host=ip.of.the.host

[proxy]

node1 ansible_host=ip.of.the.host

[webserver]

node2 ansible_host=ip.of.the.host

[database]

node3 ansible_host=ip.of.the.host

Task 2 – Ad-Hoc commands

What they mean by the use of “Ad-Hoc” is your typical ansible one liners. Which is to actually use the command ansible. I’ve placed the following ansible one liners in a file named adhoc. Remember to change the permissions on the file (chmod +x adhoc) before you run it.

adhoc

In this particular case I’m connecting as the user cloud_user, which will then use sudo to perform the commands.

#!/bin/bash

ansible -i inventory all -u cloud_user -b -kK -m user -a \
  "name=automation" --limit node3

ansible -i inventory all -u cloud_user -b -kK -m authorized_key -a \
  "user=automation \
  state=present \
  exclusive=True \
  key=\"ssh-ed25519 AAAADNzaCElZDI1NTE5AAAAIA03SY0CuxcuTSw0gEcNZg8TMLezwjsxnndmn0i1 automation@controller\"" --limit node3

ansible -i inventory all -u cloud_user -b -kK -m lineinfile -a \
  "path=/etc/sudoers \
  line='automation ALL=(ALL) NOPASSWD: ALL' \
  validate=\"/usr/sbin/visudo -cf %s\"" --limit node3

#!/bin/bash

ansible -i inventory all -u cloud_user -b -kK -m user -a \

"name=automation" --limit node3

ansible -i inventory all -u cloud_user -b -kK -m authorized_key -a \

"user=automation \

state=present \

exclusive=True \

key=\"ssh-ed25519 AAAADNzaCElZDI1NTE5AAAAIA03SY0CuxcuTSw0gEcNZg8TMLezwjsxnndmn0i1 automation@controller\"" --limit node3

ansible -i inventory all -u cloud_user -b -kK -m lineinfile -a \

"path=/etc/sudoers \

line='automation ALL=(ALL) NOPASSWD: ALL' \

validate=\"/usr/sbin/visudo -cf %s\"" --limit node3

The above is exactly the same as the playbook below (which I have named create_automation_user.yml):

---

- hosts: all
  become: yes
  tasks:

    - name: Creating the user automation
      user:
        name: automation

    - name: Add SSH-key to authorized_keys
      authorized_key:
        user: automation
        state: present
        exclusive: True
        key: "{{ item }}"
      with_file:
        - ~/.ssh/id_ed25519.pub

    - name: Add user to sudoers file
      lineinfile:
         path: /etc/sudoers
         line: 'automation ALL=(ALL) NOPASSWD: ALL'
         validate: /usr/sbin/visudo -cf %s

...

---

- hosts: all

become: yes

tasks:

- name: Creating the user automation

user:

- name: Add SSH-key to authorized_keys

authorized_key:

user: automation

state: present

exclusive: True

key: "{{ item }}"

with_file:

- ~/.ssh/id_ed25519.pub

- name: Add user to sudoers file

lineinfile:

path: /etc/sudoers

line: 'automation ALL=(ALL) NOPASSWD: ALL'

validate: /usr/sbin/visudo -cf %s

...

Task 3 – File content

motd.yml

---

- hosts: all
  become: yes

  tasks:

    - name: Change to HAproxy-motd
      copy:
        content: "Welcome to HAProxy server"
        dest: /etc/motd
      when: "'proxy' in group_names"

    - name: Change to Apache-motd
      copy:
        content: "Welcome to Apache server"
        dest: /etc/motd
      when: "'webserver' in group_names"

    - name: Change to MySQL-motd
      copy:
        content: "Welcome to MySQL server"
        dest: /etc/motd
      when: "'database' in group_names"

...

---

- hosts: all

become: yes

tasks:

- name: Change to HAproxy-motd

copy:

content: "Welcome to HAProxy server"

dest: /etc/motd

when: "'proxy' in group_names"

- name: Change to Apache-motd

copy:

content: "Welcome to Apache server"

dest: /etc/motd

when: "'webserver' in group_names"

- name: Change to MySQL-motd

copy:

content: "Welcome to MySQL server"

dest: /etc/motd

when: "'database' in group_names"

...

Task 4 – Configure SSH server

sshd.yml

---

- hosts: all
  become: yes

  tasks:

    - name: Set Banner to /etc/motd
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "^Banner"
        line: "Banner /etc/motd"

    - name: Disable X11Forwarding
      lineinfile:
         path: /etc/ssh/sshd_config
         regex: "^X11Forwarding"
         line: "X11Forwarding no"


    - name: Set MaxAuthTries to 3
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "^MaxAuthTries"
        line: "MaxAuthTries 3"

...

---

- hosts: all

become: yes

tasks:

- name: Set Banner to /etc/motd

lineinfile:

path: /etc/ssh/sshd_config

regex: "^Banner"

line: "Banner /etc/motd"

- name: Disable X11Forwarding

lineinfile:

path: /etc/ssh/sshd_config

regex: "^X11Forwarding"

line: "X11Forwarding no"

- name: Set MaxAuthTries to 3

lineinfile:

path: /etc/ssh/sshd_config

regex: "^MaxAuthTries"

line: "MaxAuthTries 3"

...

Task 5 – Ansible vault

secret.yml

Use the following command to create the ansible vault file named secret.yml:

ansible-vault create secret.yml

1	ansible-vault create secret.yml

This file should contain:

user_password: devops
database_password: devops

1 2	user_password: devops database_password: devops

Use the password devops to protect the file you create.

vault_key

Create a regular file named vault_key that contains the following:

devops

devops

Task 6 – Users and groups

This is the most difficult task I’ve encountered so far.

user_list.yml

---

users:
  - username: alice
    uid: 1201
  - username: vincent
    uid: 1202
  - username: sandy
    uid: 2201
  - username: patrick
    uid: 2202

...

---

users:

- username: alice

uid: 1201

- username: vincent

uid: 1202

- username: sandy

uid: 2201

- username: patrick

uid: 2202

...

users.yml

---

- hosts: all
  become: yes
  vars_files:
    - ./user_list.yml
    - ./secret.yml

  tasks:

    - name: Add users to the webserver hosts if UID starts with 1
      user:
          name: "{{ item.username }}"
          shell: /bin/bash
          groups: wheel
          append: yes
          uid: "{{ item.uid }}"
          password: "{{ user_password | password_hash('sha512') }}"
      with_items: "{{ users }}"
      when:
        - "'webserver' in group_names"
        - "item.uid|string|first == '1'"

    - name: Add users to the database hosts if UID starts with 2
      user:
          name: "{{ item.username }}"
          shell: /bin/bash
          groups: wheel
          append: yes
          uid: "{{ item.uid }}"
          password: "{{ user_password | password_hash('sha512') }}"
      with_items: "{{ users }}"
      when:
        - "'database' in group_names"
        - "item.uid|string|first == '2'"

    - name: Create SSH directory for users on webserver hosts
      file:
        path: "/home/{{ item.username }}/.ssh/"
        state: directory
        owner: "{{ item.username }}"
        group: "{{ item.username }}"
        mode: "0700"
      with_items: "{{ users }}"
      when:
        - "'webserver' in group_names"
        - "item.uid|string|first == '1'"

    - name: Create SSH directory for users on database hosts
      file:
        path: "/home/{{ item.username }}/.ssh/"
        state: directory
        owner: "{{ item.username }}"
        group: "{{ item.username }}"
        mode: "0700"
      with_items: "{{ users }}"
      when:
        - "'database' in group_names"
        - "item.uid|string|first == '2'"

    - name: Copy private SSH-key to users on the webserver hosts
      copy:
        src: /home/automation/.ssh/id_ed25519
        dest: "/home/{{ item.username }}/.ssh/id_ed25519"
        owner: "{{ item.username }}"
        group: "{{ item.username }}"
        mode: "0600"
      with_items: "{{ users }}"
      when:
        - "'webserver' in group_names"
        - "item.uid|string|first == '1'"

    - name: Copy private SSH-key to users on the database hosts
      copy:
        src: /home/automation/.ssh/id_ed25519
        dest: "/home/{{ item.username }}/.ssh/id_ed25519"
        owner: "{{ item.username }}"
        group: "{{ item.username }}"
        mode: "0600"
      with_items: "{{ users }}"
      when:
        - "'database' in group_names"
        - "item.uid|string|first == '2'"

...

---

- hosts: all

become: yes

vars_files:

- ./user_list.yml

- ./secret.yml

tasks:

- name: Add users to the webserver hosts if UID starts with 1

user:

shell: /bin/bash

groups: wheel

append: yes

uid: "{{ item.uid }}"

password: "{{ user_password | password_hash('sha512') }}"

with_items: "{{ users }}"

when:

- "'webserver' in group_names"

- "item.uid|string|first == '1'"

- name: Add users to the database hosts if UID starts with 2

user:

shell: /bin/bash

groups: wheel

append: yes

uid: "{{ item.uid }}"

password: "{{ user_password | password_hash('sha512') }}"

with_items: "{{ users }}"

when:

- "'database' in group_names"

- "item.uid|string|first == '2'"

- name: Create SSH directory for users on webserver hosts

file:

path: "/home/{{ item.username }}/.ssh/"

state: directory

owner: "{{ item.username }}"

group: "{{ item.username }}"

mode: "0700"

with_items: "{{ users }}"

when:

- "'webserver' in group_names"

- "item.uid|string|first == '1'"

- name: Create SSH directory for users on database hosts

file:

path: "/home/{{ item.username }}/.ssh/"

state: directory

owner: "{{ item.username }}"

group: "{{ item.username }}"

mode: "0700"

with_items: "{{ users }}"

when:

- "'database' in group_names"

- "item.uid|string|first == '2'"

- name: Copy private SSH-key to users on the webserver hosts

copy:

src: /home/automation/.ssh/id_ed25519

dest: "/home/{{ item.username }}/.ssh/id_ed25519"

owner: "{{ item.username }}"

group: "{{ item.username }}"

mode: "0600"

with_items: "{{ users }}"

when:

- "'webserver' in group_names"

- "item.uid|string|first == '1'"

- name: Copy private SSH-key to users on the database hosts

copy:

src: /home/automation/.ssh/id_ed25519

dest: "/home/{{ item.username }}/.ssh/id_ed25519"

owner: "{{ item.username }}"

group: "{{ item.username }}"

mode: "0600"

with_items: "{{ users }}"

when:

- "'database' in group_names"

- "item.uid|string|first == '2'"

...

Task 7 – Scheduled tasks

regular_tasks.yml

---

- hosts: all
  become: yes

  tasks:

    - name: Create crontab-record on proxy hosts
      cron:
        name: "Append the output of 'date' to /var/log/time.log"
        minute: "0"
        job: "date >> /var/log/time.log"
      when:
        - "'proxy' in group_names"

...

---

- hosts: all

become: yes

tasks:

- name: Create crontab-record on proxy hosts

cron:

minute: "0"

job: "date >> /var/log/time.log"

when:

- "'proxy' in group_names"

...

Task 8 – Software repositories

repository.yml

---

- hosts: all
  become: yes

  tasks:

    - name: Add yum repository on database hosts
      yum_repository:
        name: "mysql80-community"
        description: "MySQL 8.0 YUM Repo"
        baseurl: "http://repo.mysql.com/yum/mysql-8.0-community/el/8/x86_64/"
        gpgkey: "http://repo.mysql.com/RPM-GPG-KEY-mysql"
        gpgcheck: yes
        enabled: yes
      when:
        - "'database' in group_names"

...

---

- hosts: all

become: yes

tasks:

- name: Add yum repository on database hosts

yum_repository:

description: "MySQL 8.0 YUM Repo"

baseurl: "http://repo.mysql.com/yum/mysql-8.0-community/el/8/x86_64/"

gpgkey: "http://repo.mysql.com/RPM-GPG-KEY-mysql"

gpgcheck: yes

enabled: yes

when:

- "'database' in group_names"

...

Task 9 – Create and work with roles

mysql.yml

---

- hosts: database
  become: yes
  vars_files:
    - secret.yml
  roles:
    - sample-mysql

...

---

- hosts: database

become: yes

vars_files:

- secret.yml

roles:

- sample-mysql

...

sample-mysql/tasks/main.yml

You can create an empty role, named sample-mysql, by running the commands:

cd /home/automation/plays/roles/
ansible-galaxy init sample-mysql

1 2	cd /home/automation/plays/roles/ ansible-galaxy init sample-mysql

I decided to go with the package mysql-server instead of the mysql-community-server that is listed in the Lisenet exam. The contents of the file sample-mysql/tasks/main.yml:

---
# tasks file for sample-mysql

- name: Ensure partition is created
  parted:
    device: "/dev/nvme1n1"
    number: 1
    state: present

- name: Ensure volumegroup exists
  lvg:
    vg: "vg_database"
    pvs: "/dev/nvme1n1p1"

- name: Create logical volume
  lvol:
    vg: "vg_database"
    lv: "lv_mysql"
    size: "512"

- name: Create an XFS filesystem
  filesystem:
    fstype: "xfs"
    dev: "/dev/vg_database/lv_mysql"

- name: Mount lv_mysql volume on /mnt/mysql_backups
  mount:
    path: "/mnt/mysql_backups"
    src: "/dev/vg_database/lv_mysql"
    fstype: "xfs"
    state: present

- name: Ensure mysql-server and firewalld are installed
  yum:
    name: "{{ packages }}"
    state: latest
  vars:
    packages:
      - mysql-server
      - firewalld

- name: Open port 3306 in the firewall
  firewalld:
    port: "3306/tcp"
    permanent: yes
    immediate: yes
    state: enabled

- name: Ensure that service mysqld and firewalld are enabled and started
  service:
    name: "{{ item }}"
    state: started
    enabled: yes
  loop:
    - mysqld
    - firewalld

- name: Set mysql root password
  mysql_user:
    name: root
    password: "{{ database_password }}"
    state: present

- name: Apply my.cnf from a template
  template:
    src: my.cnf.j2
    dest: /etc/my.cnf
    owner: root
    group: root
    mode: 0644

...

---

# tasks file for sample-mysql

- name: Ensure partition is created

parted:

device: "/dev/nvme1n1"

number: 1

state: present

- name: Ensure volumegroup exists

lvg:

vg: "vg_database"

pvs: "/dev/nvme1n1p1"

- name: Create logical volume

lvol:

vg: "vg_database"

lv: "lv_mysql"

size: "512"

- name: Create an XFS filesystem

filesystem:

fstype: "xfs"

dev: "/dev/vg_database/lv_mysql"

- name: Mount lv_mysql volume on /mnt/mysql_backups

mount:

path: "/mnt/mysql_backups"

src: "/dev/vg_database/lv_mysql"

fstype: "xfs"

state: present

- name: Ensure mysql-server and firewalld are installed

yum:

state: latest

vars:

packages:

- mysql-server

- firewalld

- name: Open port 3306 in the firewall

firewalld:

port: "3306/tcp"

permanent: yes

immediate: yes

state: enabled

- name: Ensure that service mysqld and firewalld are enabled and started

service:

state: started

enabled: yes

loop:

- mysqld

- firewalld

- name: Set mysql root password

mysql_user:

password: "{{ database_password }}"

state: present

- name: Apply my.cnf from a template

template:

src: my.cnf.j2

dest: /etc/my.cnf

owner: root

group: root

mode: 0644

...

sample-mysql/templates/my.cnf.j2

[mysqld]
bind_address = {{ ansible_default_ipv4.address }}
skip_name_resolve
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock

symbolic-links=0
sql_mode=NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

[mysqld]

bind_address = {{ ansible_default_ipv4.address }}

skip_name_resolve

datadir=/var/lib/mysql

socket=/var/lib/mysql/mysql.sock

symbolic-links=0

sql_mode=NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES

[mysqld_safe]

log-error=/var/log/mysqld.log

pid-file=/var/run/mysqld/mysqld.pid

Task 10 – Create and work with roles (some more)

apache.yml

---

- hosts: webserver
  become: yes
  roles:
    - sample-apache

...

---

- hosts: webserver

become: yes

roles:

- sample-apache

...

sample-apache/handlers/main.yml

You can create an empty role, named sample-apache, by running the commands:

cd /home/automation/plays/roles/
ansible-galaxy init sample-apache

1 2	cd /home/automation/plays/roles/ ansible-galaxy init sample-apache

As for the contents of the file sample-apache/handlers/main.yml:

---
# handlers file for sample-apache

- name: restart_apache
  service:
    name: httpd
    state: restarted
    enabled: yes

...

---

# handlers file for sample-apache

- name: restart_apache

service:

state: restarted

enabled: yes

...

sample-apache/tasks/main.yml

---
# tasks file for sample-apache

- name: Ensure the packages httpd, mod_ssl and php are installed
  yum:
    name: ['httpd', 'mod_ssl', 'php']
    state: latest

- name: Ensure that the service httpd is enabled
  service:
    name: httpd
    state: started
    enabled: yes

- name: Ensure the firewall ports 80 and 443 are open
  firewalld:
    service: "{{ item }}"
    permanent: yes
    immediate: yes
    state: enabled
  with_items:
    - http
    - https

- name: Create index.html from template
  template:
    src: index.html.j2
    dest: /var/www/html/index.html
  notify: restart_apache

...

---

# tasks file for sample-apache

- name: Ensure the packages httpd, mod_ssl and php are installed

yum:

state: latest

- name: Ensure that the service httpd is enabled

service:

state: started

enabled: yes

- name: Ensure the firewall ports 80 and 443 are open

firewalld:

service: "{{ item }}"

permanent: yes

immediate: yes

state: enabled

with_items:

- http

- https

- name: Create index.html from template

template:

src: index.html.j2

dest: /var/www/html/index.html

notify: restart_apache

...

Task 11: Download roles from Ansible Galaxy and use them

Install the role named geerlingguy.haproxy by running these commands:

cd /home/automation/plays/
ansible-galaxy install geerlingguy.haproxy

1 2	cd /home/automation/plays/ ansible-galaxy install geerlingguy.haproxy

It will install the role in the roles-location specified in ansible.cfg. In this case, /home/automation/plays/roles/.

haproxy.yml

---

- name: Configuring HAProxy
  hosts: proxy
  become: yes
  roles:
    - geerlingguy.haproxy
  vars:
    haproxy_frontend_port: "80"
    haproxy_frontend_mode: "http"
    haproxy_backend_balance_method: "roundrobin"
    haproxy_backend_servers:
      - name: webserver1
        address: ip.of.webserver1:80
      - name: webserver2
        address: ip.of.webserver2:80
  tasks:
     - name: Ensure firewalld is installed
       yum:
         name: firewalld
         state: latest

     - name: Ensure firewalld is enabled and running
       service:
         name: firewalld
         state: started
         enabled: yes

     - name: Ensure firewalld has port 80 opened
       firewalld:
         service: http
         permanent: yes
         immediate: yes
         state: enabled

...

---

- name: Configuring HAProxy

hosts: proxy

become: yes

roles:

- geerlingguy.haproxy

vars:

haproxy_frontend_port: "80"

haproxy_frontend_mode: "http"

haproxy_backend_balance_method: "roundrobin"

haproxy_backend_servers:

- name: webserver1

address: ip.of.webserver1:80

- name: webserver2

address: ip.of.webserver2:80

tasks:

- name: Ensure firewalld is installed

yum:

state: latest

- name: Ensure firewalld is enabled and running

service:

state: started

enabled: yes

- name: Ensure firewalld has port 80 opened

firewalld:

service: http

permanent: yes

immediate: yes

state: enabled

...

Task 12: Security

We need to make sure that the package named rhel-system-roles is installed on the controller itself (not the nodes!). So run:

yum install rhel-system-roles

1	yum install rhel-system-roles

This will install the roles to the folder /usr/share/ansible/roles/.

ansible.cfg

Because the role is installed in a different location than we have specified in our ansible.cfg, we need to add this path. So the following line in ansible.cfg:

roles_path = /home/automation/plays/roles/

1	roles_path = /home/automation/plays/roles/

becomes this:

roles_path = /home/automation/plays/roles/:/usr/share/ansible/roles/

1	roles_path = /home/automation/plays/roles/:/usr/share/ansible/roles/

If you look in the folder /usr/share/ansible/roles/ now, you’ll see that there is a symlink named linux-system-roles.selinux, which points to rhel-system-roles.selinux. We will be using the symlink in the next configuration file.

selinux.yml

---

- name: Enable the boolean httpd_can_network_connect
  hosts: webserver
  become: yes
  vars:
    selinux_booleans:
      - name: httpd_can_network_connect
        state: on
        persistent: yes
  roles:
    - linux-system-roles.selinux

...

---

- name: Enable the boolean httpd_can_network_connect

hosts: webserver

become: yes

vars:

selinux_booleans:

- name: httpd_can_network_connect

state: on

persistent: yes

roles:

- linux-system-roles.selinux

...

Task 13: Use conditionals to control play execution

sysctl.yml

---

- hosts: all
  become: yes

  tasks:
    - name: Set vm.swappiness to 10 if RAM > 2GB
      sysctl:
        name: vm.swappiness
        value: "10"
        state: present
      when: "ansible_memtotal_mb >= 2048"

    - name: Report not enough memory
      fail:
        msg: "Server memory less than 2048MB. RAM size {{ ansible_memtotal_mb }}"
      when: "ansible_memtotal_mb < 2048"

...

---

- hosts: all

become: yes

tasks:

- name: Set vm.swappiness to 10 if RAM > 2GB

sysctl:

value: "10"

state: present

when: "ansible_memtotal_mb >= 2048"

- name: Report not enough memory

fail:

msg: "Server memory less than 2048MB. RAM size {{ ansible_memtotal_mb }}"

when: "ansible_memtotal_mb < 2048"

...

Task 14 – Use archiving

archive.yml

---

- hosts: database
  become: yes

  tasks:
    - name: Create the file database_list.txt
      copy:
        content: "dev,test,qa,prod"
        dest: "/mnt/mysql_backups/database_list.txt"

    - name: Compress the file with gz
      archive:
        path: "/mnt/mysql_backups/database_list.txt"
        dest: "/mnt/mysql_backups/archive.gz"
        format: gz

...

---

- hosts: database

become: yes

tasks:

- name: Create the file database_list.txt

copy:

content: "dev,test,qa,prod"

dest: "/mnt/mysql_backups/database_list.txt"

- name: Compress the file with gz

archive:

path: "/mnt/mysql_backups/database_list.txt"

dest: "/mnt/mysql_backups/archive.gz"

format: gz

...

Task 15 – Work with Ansible facts

facts.yml

---

- hosts: database
  become: yes

  tasks:
    - name: Ensure the directory exists
      file:
        path: "/etc/ansible/facts.d/"
        state: directory
        recurse: yes

    - name: Copy content to file in new directory
      copy:
        content: "[sample_exam]\nserver_role=mysql\n"
        dest: "/etc/ansible/facts.d/custom.fact"

...

---

- hosts: database

become: yes

tasks:

- name: Ensure the directory exists

file:

path: "/etc/ansible/facts.d/"

state: directory

recurse: yes

- name: Copy content to file in new directory

copy:

content: "[sample_exam]\nserver_role=mysql\n"

dest: "/etc/ansible/facts.d/custom.fact"

...

Task 16 – Software packages

packages.yml

---

- hosts: all
  become: yes

  tasks:
    - name: Install packages on proxy hosts
      yum:
        name: ['tcpdump', 'mailx']
        state: latest
      when: "'proxy' in group_names"

    - name: Install packages on database hosts
      yum:
        name: ['lsof', 'mailx']
        state: latest
      when: "'database' in group_names"

...

---

- hosts: all

become: yes

tasks:

- name: Install packages on proxy hosts

yum:

state: latest

when: "'proxy' in group_names"

- name: Install packages on database hosts

yum:

state: latest

when: "'database' in group_names"

...

Task 17 – Services

target.yml

---

- hosts: webserver
  become: yes

  tasks:
    - name: Set default target to multi-user
      file:
        src: "/lib/systemd/system/multi-user.target"
        dest: "/etc/systemd/system/default.target"
        state: link

...

---

- hosts: webserver

become: yes

tasks:

- name: Set default target to multi-user

file:

src: "/lib/systemd/system/multi-user.target"

dest: "/etc/systemd/system/default.target"

state: link

...

Task 18 – Create and use templates to create customised configuration files

server_list.j2

{% for host in groups.all %}
{{ hostvars[host].inventory_hostname }}
{% endfor %}

{% for host in groups.all %}

{% endfor %}

server_list.yml

---

- hosts: all
  become: yes

  tasks:
    - name: Create template
      template:
        src: "server_list.j2"
        dest: "/etc/server_list.txt"
        owner: automation
        mode: 0600
        setype: "net_conf_t"

...

---

- hosts: all

become: yes

tasks:

- name: Create template

template:

src: "server_list.j2"

dest: "/etc/server_list.txt"

owner: automation

mode: 0600

setype: "net_conf_t"

...

vim – Goodbye to :set paste

SimpleHTTPServer with SSL

2 Replies

I’ve often used Python’s SimpleHTTPServer to simply share a directory with someone over a network, it being either local or the Internet. In case you don’t know how it works, it’s simple. To start a HTTP server, at your current location, type:

python -m SimpleHTTPServer

1	python -m SimpleHTTPServer

and the result:

jorge@applepie:~ $ python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...

1 2	jorge@applepie:~ $ python -m SimpleHTTPServer 8080 Serving HTTP on 0.0.0.0 port 8080 ...

It listens on all IPv4 interfaces, and binds to the port you specify, which in my case is 8080. The person on the other side will then be able to access the files in the directory from the outside by going to http://server1.example.com:8080, provided that your machine has the hostname server1.example.com, and that you have the port 8080 forwarded to the IP of server1.

But what if you want to provide a secure connection, say over SSL? SimpleHTTPServer has no built in way of doing this.

But behold ssl, Python’s built in SSL-module!

To create a secure connection for your SimpleHTTPServer, first create a self signed certificate by running the following command (if you don’t have a proper SSL-certificate, that is):

openssl req -x509 -newkey rsa:4096 -keyout server1.example.com.key -out server1.example.com.pem -days 365 -nodes

1	openssl req -x509 -newkey rsa:4096 -keyout server1.example.com.key -out server1.example.com.pem -days 365 -nodes

Now create a script named shttps.py that contains the following code:

#!/usr/bin/env python

import BaseHTTPServer, SimpleHTTPServer
import ssl

## Variables you can modify

bind_to_address = ''
server_port = 8080
ssl_key_file = "/etc/ssl/certs/localcerts/server1.example.com.key"
ssl_certificate_file = "/etc/ssl/certs/localcerts/server1.example.com.pem"


## Don't modify anything below

httpd = BaseHTTPServer.HTTPServer((bind_to_address, server_port), SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket, server_side=True,
                                keyfile=ssl_key_file,
                                certfile=ssl_certificate_file)
httpd.serve_forever()

#!/usr/bin/env python

import BaseHTTPServer, SimpleHTTPServer

import ssl

## Variables you can modify

bind_to_address = ''

server_port = 8080

ssl_key_file = "/etc/ssl/certs/localcerts/server1.example.com.key"

ssl_certificate_file = "/etc/ssl/certs/localcerts/server1.example.com.pem"

## Don't modify anything below

httpd = BaseHTTPServer.HTTPServer((bind_to_address, server_port), SimpleHTTPServer.SimpleHTTPRequestHandler)

httpd.socket = ssl.wrap_socket (httpd.socket, server_side=True,

keyfile=ssl_key_file,

certfile=ssl_certificate_file)

httpd.serve_forever()

The only thing that needs further explanation is the variable bind_to_address. Fill this in with the text localhost if you want it to only listen to 127.0.0.1. Leave it blank to have it listen to all IPv4 interfaces (0.0.0.0).

Now that the certificate and key is all in place, and the script has been created, make it executable with:

chmod +x shttps.py

1	chmod +x shttps.py

Go to the folder you’d like to share the contents of, and run the script:

jorge@applepie:~ $ ls
foo/ shttps.py
jorge@applepie:~ $ cd foo
jorge@applepie:~/foo $ ls
hello.txt world.txt
jorge@applepie:~/foo $ ../shttps.py

jorge@applepie:~ $ ls

foo/ shttps.py

jorge@applepie:~ $ cd foo

jorge@applepie:~/foo $ ls

hello.txt world.txt

jorge@applepie:~/foo $ ../shttps.py

The result when you visit https://server1.example.com:8080?Because there is no third party verification it’s listed as insecure, but it should do the trick well enough for sharing files with others.

If you however do want a free SSL certificate for a more permanent setup, I suggest LetsEncrypt! Check out https://letsencrypt.org/getting-started/ for more information.

VMware, i3 and multiple monitors

4 Replies

For a while now I’ve been trying to set up VMware to work with multiple monitors, in a Linux guest. With some windowmanagers it works out of the box without any issue, such as with Unity. I never figured out how to do it with xmonad, and recently I switched to i3 just to try something new. The damn “Cycle multiple monitors” button didn’t work here either. When I tried it, a message popped up saying:

The virtual machine must have up-to-date VMware Tools installed and running.

..which it had! At this point I had installed vmware-tools, which is described as:

“A suite of utilities that enhances the performance of the virtual machine’s guest operating system and improves management of the virtual machine”

However, I found a solution! Place the following line in your i3 configuration file, whether it be ~/.i3/config or ~/.config/i3/config:

exec --no-startup-id vmware-user

1	exec --no-startup-id vmware-user

..and that’s it! Reload your i3 configuration, and now you should be able to press the “Cycle multiple monitors” button and have dual monitors in your VMware guest!

Now, if you’re using open-vm-tools instead of the native vmware-tools, do what Fabian suggested – use the following line in your config-file instead:

exec -–no-startup-id vmware-user-suid-wrapper

1	exec -–no-startup-id vmware-user-suid-wrapper

It should work!

ncat, a modern implementation of netcat

Shiny new things

A couple of the features of ncat, some of which are new, are:

IPv6 Support
Chain multiple ncat together
Support for SSL
Ability to specify specific hosts to allow or deny access to in listen mode

While the new features are great, it’s important to note that ncat is not 100% reverse compatible with the original netcat.

Examples

Let’s continue with a couple of examples to get you started.

IPv4 or IPv6?

To force ncat to only use either IPv4 og IPv6, use:

-4
-6

..as in:

ncat -6 <server> 10100

1	ncat -6 <server> 10100

..to connect to a server only through IPv6.

ncat -C scanme.nmap.org 80

1	ncat -C scanme.nmap.org 80

..and type in:

GET / HTTP/1.0

1	GET / HTTP/1.0

..and press enter twice. The result will be something along the lines of:

...
HTTP/1.1 200 OK
Date: Fri, 25 Nov 2016 09:01:08 GMT
Server: Apache/2.4.7 (Ubuntu)
Accept-Ranges: bytes
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
...

...

HTTP/1.1 200 OK

Date: Fri, 25 Nov 2016 09:01:08 GMT

Server: Apache/2.4.7 (Ubuntu)

Accept-Ranges: bytes

Vary: Accept-Encoding

Connection: close

Content-Type: text/html

...

The option -C is used because it requires CRLF line endings.

Chaining

An example from nmap’s website; sending a log file from host1 to host3, by way of host2:

host3

ncat -l > log.txt

1	ncat -l > log.txt

host2

ncat -l --sh-exec "ncat host3"

1	ncat -l --sh-exec "ncat host3"

host1

ncat --send-only host2 < log.txt

1	ncat --send-only host2 < log.txt

Cloning partitions over the network

One of the more useful tricks is the ability to clone partitions over the network.

On the system you’d like to clone the partition from, do:

dd if=/dev/sda | ncat -l 10100

1	dd if=/dev/sda \| ncat -l 10100

..and on the receiving machine:

ncat <server> 10100 | dd of=/dev/sda

1	ncat <server> 10100 \| dd of=/dev/sda

To speed up the process of transfer you can always throw in gzip for compression:

dd if=/dev/sda | gzip -9 | ncat -l 10100

1	dd if=/dev/sda \| gzip -9 \| ncat -l 10100

..and:

ncat <server> 10100 | gzip -d | dd of=/dev/sda

1	ncat <server> 10100 \| gzip -d \| dd of=/dev/sda

Web server

Setting up a simple webserver is also easy:

ncat -l 8080 -k --sh-exec "echo -e 'HTTP/1.1 200 OK\r\n'; cat index.html"

1	ncat -l 8080 -k --sh-exec "echo -e 'HTTP/1.1 200 OK\r\n'; cat index.html"

The option -k makes ncat keep listening and accepting more connections after the first one is finished.

File transfer with SSL

On the machine you want to send the file from:

ncat -l 10100 --ssl --send-only < secret.tar.gz

1	ncat -l 10100 --ssl --send-only < secret.tar.gz

..and on the receiving end:

ncat <server> 10100 --ssl > secret.tar.gz

1	ncat <server> 10100 --ssl > secret.tar.gz

The option –send-only does what it says – it only sends data and ignores received.

Ports

Need to check if a port is open? Try:

nc -z -v -w5 <host> <port>

				1

						nc -z -v -w5 <host> <port>

This example checks if port 53 is open, with a timeout of 5 seconds. When a port is open:

$ nc -z -v -w5 dns.example.com 53
Connection to dns.example.com 53 port [tcp/domain] succeeded!

				1
2

						$ nc -z -v -w5 dns.example.com 53
Connection to dns.example.com 53 port [tcp/domain] succeeded!

..and when it’s closed:

$ nc -z -v -w5 dns.example.com 52
nc: connect to dns.example.com port 52 (tcp) timed out: Operation now in progress

				1
2

						$ nc -z -v -w5 dns.example.com 52
nc: connect to dns.example.com port 52 (tcp) timed out: Operation now in progress

Chat server

As far I know, the are two main ways to do this.

First way

Start listening on a port of your choice:

ncat -l 10100

1	ncat -l 10100

..and connect to it from another machine:

ncat <server> 10100

1	ncat <server> 10100

Type in some text and the line will appear on the other machine when you press enter. You won’t be able to see who wrote what, but hey, it’s good enough if you want to communicate with someone.

Second way

The new fancier way of starting a chat-server is by using –chat:

ncat --chat -l 10100

1	ncat --chat -l 10100

Users who then want to connect to the chat:

ncat <server> 10100

1	ncat <server> 10100

The output will be something along the lines of:

<user0> Hello?
<user5> Is it me you're looking for?

1 2	<user0> Hello? <user5> Is it me you're looking for?

The user IDs generated by ncat are based on the file descriptor for each connection and must be considered arbitrary. Also, you won’t see <userX> in front of the text you type, but others will see it. The main difference when using –chat is that you and every user connected to the server will get a <userX> tag, making it easier to see who wrote what.

Mail client

ncat also works as a mail client. Expect to type a lot:

ncat -C mail.example.com 25

1	ncat -C mail.example.com 25

..followed up by typing:

220 mail.example.com ESMTP
HELO client.example.com
250 mail.example.com Hello client.example.com
MAIL FROM:a@example.com
250 OK
RCPT TO:b@example.com
250 Accepted
DATA
354 Enter message, ending with "." on a line by itself
From: a@example.com
To: b@example.com
Subject: Greetings from ncat

This short message is brought to you by ncat.
.
250 OK
QUIT
221 mail.example.com closing connection

220 mail.example.com ESMTP

HELO client.example.com

250 mail.example.com Hello client.example.com

MAIL FROM:a@example.com

250 OK

RCPT TO:b@example.com

250 Accepted

DATA

354 Enter message, ending with "." on a line by itself

From: a@example.com

To: b@example.com

Subject: Greetings from ncat

This short message is brought to you by ncat.

250 OK

QUIT

221 mail.example.com closing connection

TCP/UDP daytime server

The daytime service, defined in RFC 867, sends a human-readable date and time string over TCP or UDP port 13. It ignores any input. So, we can use:

ncat -l 13 --keep-open --send-only --exec "/bin/date"

1	ncat -l 13 --keep-open --send-only --exec "/bin/date"

Add –udp to create an UDP daytime server instead.

Access control

Allow one host, deny others

ncat -l --allow 10.0.0.2

1	ncat -l --allow 10.0.0.2

Deny one host, allow others

ncat -l --deny 10.0.0.2

1	ncat -l --deny 10.0.0.2

Allow or deny hosts from file

ncat -l --allowfile trusted-hosts.txt

1	ncat -l --allowfile trusted-hosts.txt

Replace –allowfile with –denyfile to deny and trusted-hosts.txt with a file that contains the hosts to be denied.

These are just a few of the things that you can do with ncat. Have fun exploring the rest!

Task 1 – Ansible installation and configuration

ansible.cfg

inventory

Task 2 – Ad-Hoc commands

adhoc

Task 3 – File content

motd.yml

Task 4 – Configure SSH server

sshd.yml

Task 5 – Ansible vault

secret.yml

vault_key

Task 6 – Users and groups

user_list.yml

users.yml

Task 7 – Scheduled tasks

regular_tasks.yml

Task 8 – Software repositories

repository.yml

Task 9 – Create and work with roles

mysql.yml

sample-mysql/tasks/main.yml

sample-mysql/templates/my.cnf.j2

Task 10 – Create and work with roles (some more)

apache.yml

sample-apache/handlers/main.yml

sample-apache/tasks/main.yml

Task 11: Download roles from Ansible Galaxy and use them

haproxy.yml

Task 12: Security

ansible.cfg

selinux.yml

Task 13: Use conditionals to control play execution

sysctl.yml

Task 14 – Use archiving

archive.yml

Task 15 – Work with Ansible facts

facts.yml

Task 16 – Software packages

packages.yml

Task 17 – Services

target.yml

Task 18 – Create and use templates to create customised configuration files

server_list.j2

server_list.yml

Shiny new things

Examples

IPv4 or IPv6?

Banner grabbing

Chaining

host3

host2

host1

Cloning partitions over the network

Web server

File transfer with SSL

Ports

Chat server

First way

Second way

Mail client

TCP/UDP daytime server

Access control

Allow one host, deny others

Deny one host, allow others

Allow or deny hosts from file