Automation with Ansible Lab - Hsanokklis/2023-2024-Tech-journal GitHub Wiki

Pre-Lab Information

Your vSphere Environment

Web, nmon and docker have been deleted

VM's kept are ad01, mgmt01 and wks01

You have new VMs, controller(ubuntu), ansible1(centos), and ansible2(rocky)

Networking

controller: 10.0.5.90

ansible1: 10.0.5.91

ansible2: 10.0.5.92

Linux Accounts

Create the following accounts:

On Controller created a named sudo user (hannelore) and another sudo user named deployer

sudo -i
adduser hannelore
usermod -aG sudo hannelore 
adduser deployer
usermod -aG sudo deployer

On ansible1 and ansible2 create a named sudo user named deployer

All deployer passwords should be the same

#ansible1 
sudo adduser deployer
sudo passwd deployer
sudo usermod -aG wheel deployer

#ansible2 
sudo adduser deployer
sudo passwd 
usermod -aG wheel deployer

Regular Setup

not domain joined

Controller (ubuntu)

Change host name of controller to `controller-hannelore
- vi /etc/hostname
- Preserve hostname in vi /etc/cloud/cloud.cfg
- reboot
Configure IP address via netplan
- sudo vi /etc/netplan/00-installer-config.yaml
- sudo netplan apply

Add IP address to DNS Server

ansible1 (centos)

set hostname and IP address using nmtui
- ansible2-hannelore
- 10.0.5.91
Add IP address to DNS Server

ansible2 (rocky)

set hostname and IP address using nmtui
- ansible2-hannelore
- 10.0.5.92
Add IP address to DNS Server

Disable SSH Root Login

sudo vi /etc/ssh/sshd_config

Check connection/dns via ssh, nslookup and ping

SSH from mgmt-hanne via PuTTY to controller-hannelore
nslookup controller-hannelore ad01-hannelore
ping -c1 ansible1-hannelore
ping -c1 ansible2-hannelore
ping -c1 champlain.edu

TROUBLESHOOTING: When I was doing the nslookup of ad01-hannelore I kept getting this for the server:

I thought that this was an error, as it is not the server IP address, but it turns out Ubuntu is just wonky, and it has its own DNS services, so that it caches the IP address of the server I was querying with it's own DNS. That is what the 127.0.0.53 address is.

SEE DELIVERABLE 1

Test deployer account on `controller-hannelore`

sudo su - deployer
sudo - i

SEE DELIVERABLE 2

Installing Ansible

Install ansible via root@controller-hannelore
- sudo apt install ansible sshpass python3-paramiko

SEE DELIVERABLE 3

Create `/etc/sudoers.d/sys265` on all Linux systems

Create RSA Key pair on `controller`

As the deployer user on controller, create an RSA keypair with a passphrase protected private key
- ssh-keygen
- use defualt directory to save key
- make passphrase

using ssh-copy-id, add deployer@controller's public key to the deployer accounts on ansible1 and ansible2.
- ssh-copy-id deployer@ansible1-hannelore
- ssh-copy-id deployer@ansible2-hannelore

Link used: https://github.com/Hsanokklis/2023-2024-Tech-journal/wiki/Automation-Lab

Demonstrate passwordless login for ansible boxes

eval $(ssh-agent)
ssh-add-t 14400

Passwordless SSH to ansible1 and ansible2

SEE DELIVERABLE 4

First run

Setup the following directory hierarchy and inventory file on controller-yourname. The assumption is that ansible1-yourname and ansible2-yourname resolve via DNS. Run the first ansible ping.

pwd 
mkdir -p ansible/roles 
cd ansible/ 
echo ansible1-hannelore >> inventory.txt
echo ansible2-hannelore >> inventory.txt 
cat inventory.txt 
ansible all -m ping -i inventory.txt

Ad-hoc commands

Ad-hoc commands

These are one-off commands that are executed on the command of an ansible control node. They don't need a playbook or any additional configuration.

Links:

https://www.tutorialspoint.com/ansible/ansible_ad_hoc_commands.htm#:~:text=Ad%20hoc%20commands%20are%20commands,usr%2Fbin%2Fansible'.

https://medium.com/@saurabhdahibhate50/mastering-ad-hoc-commands-in-ansible-a-comprehensive-guide-506e81dcd9b2#:~:text=Ad%20hoc%20commands%20are%20one,service%20or%20installing%20a%20package.

Try a few ad-hoc operating system commands similar to the use of id below

This command executes the id command on all hosts in the inventory.txt file. The id command typically displays the user associated with the current process (UID)

ad-hoc ping servers in the inventory file

ansible all -m ping -i inventory.txt

SEE DELIVERABLE 5

Update your inventory to categorize your ansible2 host by type. Then test ping against just the hosts under the [webmin] tag.

Webmin playbook Installation

The playbook installation used in the lab does not work via ansible galaxy. So I used another playbook created by Matt Compton for playbook.

Put the .webmin.yml file in the /ansible/roles directory

Link: https://git.goober.cloud/matt/sys265-ansible/src/branch/main/webmin.yml

---
- name: Install Webmin on CentOS
  hosts: webmin
  become: yes
  tasks:
    - name: Install required packages
      yum:
        name:
          - wget
          - perl
          - perl-Net-SSLeay
          - openssl
          - perl-Encode-Detect
          - perl-Data-Dumper
        state: present

    - name: Download Webmin RPM
      get_url:
        url: http://www.webmin.com/download/rpm/webmin-current.rpm
        dest: /tmp/webmin-current.rpm

    - name: Install Webmin
      yum:
        name: /tmp/webmin-current.rpm
        state: present
        disable_gpg_check: yes

    - name: Add fireall rule
      firewalld:
        port: 10000/tcp
        permanent: true
        state: enabled

    - name: ReStart firewall Service
      service:
        name: firewalld
        state: restarted
        enabled: yes

    - name: Start Webmin Service
      service:
        name: webmin
        state: started
        enabled: yes

Execute the playbook

ansible-playbook -i inventory.txt roles/webmin.yml

The reason that webmin only executes on ansible2 is because we labeled it as so in the inventory.txt file with [webmin].

Login to webmin as root@ansible2

SEE DELIVERABLE 6

Install your own role with Ansible Galaxy

For this step I tried a variety of methods and playbooks. I first followed what @savannahc502 did and attempted to install wordpress via this role. After I wrote my wordpress.yml file, the playbook would start to run and then it would fail when it tried to start mariadb. I then uninstalled this role and installed this one, that does the exact same thing. When I ran this one, I was met with the exact same mariadb error.

Here are the steps I took for setting these up even tho they didn't work:

installed role

Set role for ansible 1 as [wordpress]

wordpress.yml configuration

I use this role to install Git on Centos: https://galaxy.ansible.com/ui/standalone/roles/mauromedda/ansible_role_git/documentation/

SSH into ansible1 and running git commands

making a clone of my repo

Pushing the file AnsibleFun to my Github

SEE DELIVERABLE 7 & 8

Windows Automation

Preparing MGMT01 for Ansible

Start Windows Update Service

Open the Services application as an administrator
Go to Windows Update
Change from disabled to Automatic

Install OpenSSH via Powershell Admin Prompt

Check for Installation with command
- `Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH**'

You will see above that OpenSSH client is installed but OpenSSh server is not, so we must install that!

Install OpenSSH server
- Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Once finished you will see the output below:

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

Set Powershell to be the Default Shell for SSH

Set-ItemProperty "HKLM:\Software\Microsoft\Powershell\1\ShellIds" -Name ConsolePrompting -Value $true
New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

SSH into `mgmt01-hanne`

TROUBLESHOOTING: When I was attempting to ssh to mgmt01-hanne from deployer@controller-hannelore I kept being met with a Permission Denied, try again message. I know that my credentials were correct, and I had signed into the Admin CMD/Services/Powershell with them successfully. Initially I didn't think it was an issue with OpenSSH. The OpenSSH client was already in Windows additional features, so all I had to was install the OpenSSH server via powershell. I had no issues doing this with the lab instructions and was able to install it successfully. You will see below I attempted many troubleshooting methods to try and figure out why I was getting a permission denied errors. My last method was to uninstall both the client and server and then reinstall it. Savannah Ciak used a different method to install the server, so I used the link she followed, and it ended up working!

start/stop sshd

net stop sshd

net start sshd

create new local account

Link used: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/new-localuser?view=powershell-5.1

view/change sshd file

notepad %programdata%\ssh\sshd_config

Uninstall client/server

in Settings --> Manage Optional Features, I uninstalled the client and server

Reinstall with different method

Download OpenSSH-Win64 zip (https://github.com/PowerShell/Win32-OpenSSH/releases)

Unblock-File .\Downloads\OpenSSH-Win64.zip

Expand-Archive .\Downloads\OpenSSH-Win64.zip -DestinationPath .

Copy-Item -Recurse .\OpenSSH-Win64\ 'C:\'

&icacls C:\OpenSSH-Win64\libcrypto.dll /grant Everyone:RX

C:\OpenSSH-Win64\install-sshd.ps1

&sc.exe config sshd start= auto

&sc.exe config ssh-agent start=auto

&sc.exe start sshd

Make sure Windows Defender Firewall is open for port 22

New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 Program "C:\OpenSSH\sshd.exe"`

make sure to make set powershell as the default to shh as seen above

SEE DELIVERABLE 9

reboot for windows shutdown /t 0 /r

Update Inventory File with new group

Update your inventory file to add a new group called windows with mgmt01-yourname as the host in that group. Also include the variables associated with that group [windows:vars].

SEE DELIVERABLE 10

Add `wks01-hannelore` to inventory

Add wks1 to your inventory under the windows category and rerun the win_ping.

Add SSH Service on Windows with steps above

SSH services were no installed on Wks as seen in the screenshot below, so we have to install them, like we did above.

Download OpenSSH-Win64 zip (https://github.com/PowerShell/Win32-OpenSSH/releases)

Unblock-File .\Downloads\OpenSSH-Win64.zip
Expand-Archive .\Downloads\OpenSSH-Win64.zip -DestinationPath .
Copy-Item -Recurse .\OpenSSH-Win64\ 'C:\'
&icacls C:\OpenSSH-Win64\libcrypto.dll /grant Everyone:RX C:\OpenSSH-Win64\install-sshd.ps1

&sc.exe config sshd start= auto
&sc.exe config ssh-agent start=auto
&sc.exe start sshd

Make sure Windows Defender Firewall is open for port 22

New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 Program "C:\OpenSSH\sshd.exe"

Set powershell to be default shell for SSH

Set-ItemProperty "HKLM:\Software\Microsoft\Powershell\1\ShellIds" -Name ConsolePrompting -Value $true
New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value "C\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

Fix the `wks01-hannelore` ping problem

Add the lines below to a ansible.cfg file

I fixed the problem by waiting a week and then uninstalling and reinstalling things again and it worked!

Software deployment using win_chocolatey

Construct a new playbook within the roles directory called windows_software.yml. This is a simple playbook that uses built-in ansible functionality as opposed to a downloaded role. The list of tasks below will use a module called win_chocolatey which is a package manager for Windows similar to apt-get or yum that is becoming more popular in enterprises.

Creating the `windows_software.yml` file

Installing Chocolatey manually

Install on both mgmt01-hanne and wks01-hannelore

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

Link used: https://chocolatey.org/install

Run playbook

ansible-playbook -i inventory.txt roles/windows_software.yml -u [email protected] --ask-pass

Add Notepad++ to `wks1` and `mgmt01`

See if you can figure out how to add the Notepad++ for windows package to wks1 and mgmt01. Rerun your playbook.

to do this, I added a line in the yml file that said notepadplusplus

Re-run playbook

Deliverables

Deliverable 1: A screenshot showing an SSH session from mgmt01 to controller and within that session a DNS lookup for controller against ad01, pinging ansible1, ansible2 and champlain.edu

Deliverable 2. Within your ssh login as a named sudo user, use sudo su - deployer to switch to the deployer user. Provide a screenshot similar to the one below.

Deliverable 3. Provide a screenshot indicating a successful ansible installation:

Deliverable 4. Demonstrate passwordless ssh with rsa authentication to both ansible1 and ansible2 from the controller. Provide a screenshot that shows passwordless authentication and then passwordless elevation to root on each system.

Deliverable 5. Provide a screenshot of one of your executed commands (not id)

Deliverable 6. Provide a screenshot that shows some aspect of Webmin's logged-in interface

Deliverable 7: Deploy a different role to ansible1. Provide a screenshot of your successful playbook execution

Deliverable 8: Provide a screenshot of your new service functionality from a remote client perspective.

Deliverable 9. Provide a screenshot that shows a successful ssh login to a powershell prompt from controller

Deliverable 10. Provide a screenshot that shows a successful win_ping from controller to mgmt01.

Deliverable 11. Rerun the playbook with successful pings on wks1 and mgmt1 similar to the one below

Deliverable 12. Provide a screenshot showing the successful playbook run and software Installation

Deliverable 13. Provide a screenshot from an ssh session to mgmt01 that displays installed packages similar to the one below, notepad++ should be there.

Deliverable 14. Link to your wiki. You should clearly document the commands used to install ansible on your controller, prepare linux and windows hosts for automation, as well as upload and link your various ansible specific configuration files and playbooks used in the course of this lab.