This is an old revision of the document!

Ansible

Experimenting environment

Here is an environment for experimenting:

https://github.com/skipidar/ExperimentsProject-4Ansible-usingVagrant/wiki

Configuration of ansible

Add hosts here: /etc/ansible/hosts

local ansible_host=127.0.0.1   ansible_connection=local

slave ansible_host=10.0.0.11 ansible_user=vagrant ansible_ssh_private_key_file=/home/vagrant/.ssh/key.myexperimental.openssh.ppk

Add the ssh private-key in openSSH form here, which will be used by ansible

/home/vagrant/.ssh/id_rsa

Example:

Add the ssh public-key in openSSH form here, which will be used by ansible

/home/vagrant/.ssh/authorized_keys

Example:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAxQRyoCBSijfLHpuQKR+0/nsO4p66r4xDre0nJZ8FgHwW+ATdzRr/Mu6C5DgS1ENY9No8yOH56zqnqlhoQpTY5d+wypbkkF3AG3N0D0DrHK4CHjjPNylHAm4+ATuU68agYOVTPycY19DXaAgQBqtJlRVHhMB9ZJ+ugAdKINjpW//8uwvPHisH6GYbA5zWugNHmyfNLdYdJcdozTUprHFkRz6E2HyCxEuhurbcHtsEEfgCd93fbHn2utRg24VIRFNZF24C6N/OSrsmdKbYsQV/VygHEo6VYM4DUOcz1nzU5f3f5k1pitgBbyVqIID++XwxNCl8wAjUWFEHvA+xyf4Zyw== rsa-key-20170928vagrant@master:~$

Configure the ssh-key permissions. Ansible will check them and if someone else can access the keys decine the usage of the key.

chmod -R 700 /home/vagrant/.ssh

Debugging the connection

Try connecting to the server using ssh

ssh ec2-user@48.114.120.127 -p 22 -i /root/vagrant-home/ssh/demokey.pem

Try using the -vvvv parameter.

ansible slave -vvvv -m ping

Introduction

Here is a good introduction: https://serversforhackers.com/c/an-ansible-tutorial

Commands

Send a command to all ansible hosts

ansible all -m ping -u "ec2-user"

Send a command to slave only

ansible slave -m ping -u "ec2-user"

Execute a shell command remotely.
The module used here is shell - it is not that the shell is executed remotely, but using the argument -m an ansible module is used. The -a flag is used to pass any arguments to the module

ansible all -s -m shell -a 'apt-get install nginx'

Playbook

Hierarchy:

Playbook
- Tasks - declarative describtion of as to be state
- Handlers - secondary, after tasks

Tasks

Create the following playbook in a file addmycowsay.yaml

---
- hosts: local
  tasks:
   - name: install cowsay
     apt: pkg=cowsay state=installed update_cache=true

And execute the playbook

ansible-playbook addmycowsay.yaml

So the syntax is the following:

---
- hosts: <LOCATION>
  tasks:
   - name: <COMMENT>
     <MODULE>: pkg=<APT_PACKAGE> state=installed update_cache=true

Handlers

---
- hosts: local
  tasks:
   - name: Install Nginx
     apt: pkg=nginx state=installed update_cache=true
     notify:
      - Start Nginx

  handlers:
   - name: Start Nginx
     service: name=nginx state=started

Become non root

To allow becoming non priviledged user to things must be set to True in /etc/ansible/ansible.cfg

Important: The given settings must be uncommented at the right locations in ansible.cfg. It is insufficient to append those settings to ansible.cfg.

allow_world_readable_tmpfiles = True
pipelining = True

To uncomment them programmatically do

sed -i 's/.*pipelining.*/pipelining = True/' /etc/ansible/ansible.cfg
sed -i 's/.*allow_world_readable_tmpfiles .*/allow_world_readable_tmpfiles = True/' /etc/ansible/ansible.cfg

Here is an example playbook, which shows how to become the user “oracle”

# Setup the infrastructure for Faktura
- hosts: "myhost"
  become: yes
  become_method: sudo
  become_user: oracle
  vars:
    allow_world_readable_tmpfiles: true
  tasks:         


        # an error is thorwn when becoming unpriviledged user. Hence use sudo
        - name: install oracle client
          shell: |
                whoami
          args:
            chdir: /tmp/client
          environment:
            DISTRIB: /tmp/client

Remove Old SSH Key Fingerprint

When connecting to an unknown host - your are asked whether to trust it. Linux then stores a fingerprint of the key associated with the host.

If the host then changes, e.g. because of the replacement of the EC2 machine behind the host - connection will fail.

To remove the fingerprint do:

ssh-keygen -R '45.157.214.126'

Extra vars

Pass external variables to the playbook, to e.g. define hosts outside of the playbook.

ansible-playbook myplaybook.yaml --extra-vars "host=yourhost"

And here is myplaybook:

- hosts: "{{ host }}"
  become: true
  become_method: sudo
  become_user: root
  
  ...

Tohuwabohu excorcism

Table of Contents