Cactus Howto - User contributions [en]

Main Page

2021-07-14T09:33:47Z

Tim:

* Security
** Encryption
*** [[OpenSwan VPN]]
*** [[Letsencrypt Howto]]
** Firewalling
*** [[Migrate FortiGate 60D to FortiWiFi 60E]]
* Webpublishing
** [[MediaWiki Howto]]
* Container
** [[Docker.io Howto]]
* Automation
** [[Ansible Howto]]
* Android
** [[Android rsync App]]
** [[Android VCF Import]]
* [[Ubuntu Howtos]] (desktop, server)
* [[Phone stuff]]
* Development Tools
** Anonymizer - Tool for anonymizing network config files: https://github.com/tpurschke/IP-anonymizer
NB: this perl script
- can be used to anonymize config files (router, firewall)
- replaces IP addresses as well as strings
- requires the non-standard module "NetAddr::IP"
* Return to Cactus main page: https://www.cactus.de

Main Page

2021-06-26T18:12:10Z

Tim: Created page with "* Security ** Encryption *** OpenSwan VPN *** Letsencrypt Howto ** Firewalling *** Migrate FortiGate 60D to FortiWiFi 60E * Webpublishing ** MediaWiki Howto *..."

* Security
** Encryption
*** [[OpenSwan VPN]]
*** [[Letsencrypt Howto]]
** Firewalling
*** [[Migrate FortiGate 60D to FortiWiFi 60E]]
* Webpublishing
** [[MediaWiki Howto]]
* Container
** [[Docker.io Howto]]
* Automation
** [[Ansible Howto]]
* Android
** [[Android rsync App]]
** [[Android VCF Import]]
* [[Ubuntu Howtos]] (desktop, server)
* [[Phone stuff]]
* Development Tools
** Anonymizer - Tool for anonymizing network config files: https://github.com/tpurschke/iso-anonymizer
NB: this perl script
- can be used to anonymize config files (router, firewall)
- replaces IP addresses as well as strings
- requires the non-standard module "NetAddr::IP"
* Return to Cactus main page: https://www.cactus.de

Hauptseite

2020-01-15T21:00:26Z

Tim:

* Security
** Encryption
*** [[OpenSwan VPN]]
*** [[Letsencrypt Howto]]
** Firewalling
*** [[Migrate FortiGate 60D to FortiWiFi 60E]]
* Webpublishing
** [[MediaWiki Howto]]
* Container
** [[Docker.io Howto]]
* Automation
** [[Ansible Howto]]
* Android
** [[Android rsync App]]
** [[Android VCF Import]]
* [[Ubuntu Howtos]] (desktop, server)
* [[Phone stuff]]
* Development Tools
** Anonymizer - Tool for anonymizing network config files: https://github.com/tpurschke/iso-anonymizer
NB: this perl script
- can be used to anonymize config files (router, firewall)
- replaces IP addresses as well as strings
- requires the non-standard module "NetAddr::IP"
* Return to Cactus main page: https://www.cactus.de

Ansible Howto

2019-09-22T15:39:51Z

Tim: /* Restore */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
as root:
echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver-options http-proxy=http://10.5.1.10:3128/ --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim

install sudo (as root, if sudo does not exist)
apt-get install sudo
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

== using ansible via cron in pull mode ==

see https://github.com/ansible/ansible-examples/blob/master/language_features/ansible_pull.yml

= ansible tower / AWX =

== Documentation ==
Documentation setting up AWX: https://www.jeffgeerling.com/blog/2017/ansible-open-sources-ansible-tower-awx

* prepare
tower-cli config host http://<old-awx-host.example.com>
tower-cli config username <user>
tower-cli config password <pass>

== Backup & Restore ==
Backup and restore (or migration): https://github.com/autops/awx-migrate, https://github.com/ansible/awx/blob/devel/DATA_MIGRATION.md

=== Backup ===
tower-cli receive --all > assets.json

=== Restore ===
tower-cli send backup.json

Then add credentials manually as they are not part of the backup.

Ansible Howto

2019-09-22T15:38:57Z

Tim: /* Restore */

Ansible Howto

2019-09-22T15:36:54Z

Tim: /* ansible tower / AWX */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
as root:
echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver-options http-proxy=http://10.5.1.10:3128/ --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim

install sudo (as root, if sudo does not exist)
apt-get install sudo
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

== using ansible via cron in pull mode ==

see https://github.com/ansible/ansible-examples/blob/master/language_features/ansible_pull.yml

= ansible tower / AWX =

== Documentation ==
Documentation setting up AWX: https://www.jeffgeerling.com/blog/2017/ansible-open-sources-ansible-tower-awx

* prepare
tower-cli config host http://<old-awx-host.example.com>
tower-cli config username <user>
tower-cli config password <pass>

== Backup & Restore ==
Backup and restore (or migration): https://github.com/autops/awx-migrate, https://github.com/ansible/awx/blob/devel/DATA_MIGRATION.md

=== Backup ===
tower-cli receive --all > assets.json

=== Restore ===
./setup.sh -e 'restore_backup_file=/path/to/nondefault/backup.tar.gz' -r

Ansible Howto

2019-02-26T12:26:38Z

Tim: /* ansible tower / AWX */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
as root:
echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver-options http-proxy=http://10.5.1.10:3128/ --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim

install sudo (as root, if sudo does not exist)
apt-get install sudo
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

== using ansible via cron in pull mode ==

see https://github.com/ansible/ansible-examples/blob/master/language_features/ansible_pull.yml

= ansible tower / AWX =

* documentation setting up AWX: https://www.jeffgeerling.com/blog/2017/ansible-open-sources-ansible-tower-awx
* backup and restore (or migration): https://github.com/autops/awx-migrate, https://github.com/ansible/awx/blob/devel/DATA_MIGRATION.md
* prepare
tower-cli config host http://<old-awx-host.example.com>
tower-cli config username <user>
tower-cli config password <pass>
* backup
tower-cli receive --all > assets.json

Ansible Howto

2019-02-26T12:01:32Z

Tim:

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
as root:
echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver-options http-proxy=http://10.5.1.10:3128/ --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim

install sudo (as root, if sudo does not exist)
apt-get install sudo
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

== using ansible via cron in pull mode ==

see https://github.com/ansible/ansible-examples/blob/master/language_features/ansible_pull.yml

= ansible tower / AWX =

* documentation setting up AWX: https://www.jeffgeerling.com/blog/2017/ansible-open-sources-ansible-tower-awx
* backup and restore (or migration): https://github.com/autops/awx-migrate, https://github.com/ansible/awx/blob/devel/DATA_MIGRATION.md
** prepare
tower-cli config host http://<old-awx-host.example.com>
tower-cli config username <user>
tower-cli config password <pass>
** backup
tower-cli receive --all > assets.json

Ansible Howto

2019-02-17T17:24:59Z

Tim: /* ansible advanced topics */

Ansible Howto

2019-02-04T21:52:13Z

Tim: /* on ubuntu older than 18.04 and debian (up to 9/stretch) */

Ansible Howto

2019-02-04T21:52:02Z

Tim: /* on ubuntu older than 18.04 and debian (up to 9/stretch) */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
as root:
echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo sudo apt-key adv --keyserver-options http-proxy=http://10.5.1.10:3128/ --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim

install sudo (as root, if sudo does not exist)
apt-get install sudo
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2019-01-25T20:13:37Z

Tim: /* prepare a client for ansible usage */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim

install sudo (as root, if sudo does not exist)
apt-get install sudo
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2019-01-25T20:12:29Z

Tim: /* installation */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ansible host ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2019-01-20T19:45:51Z

Tim: /* setup ssh shell */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
then add
eval `keychain --eval id_rsa`
to $HOME/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-23T17:27:53Z

Tim: /* prepare a client for ansible usage */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

=== Install python (if it does not already exist) ===
sudo apt install python

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-23T17:21:19Z

Tim: /* setup ssh shell */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

Make ssh timeout resistant:
tim@spike-vm:~$ cat .ssh/config
Host *
ServerAliveInterval 240

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-09T18:57:03Z

Tim: /* additional useful packages on (debian) clients */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on clients ===
install acl package to make sure "become_user" works correctly in debian:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
install python (needed for Fedora clients):
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-09T18:56:16Z

Tim: /* additional useful packages on (debian) clients */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on (debian) clients ===
install acl package to make sure "become_user" works correctly:
ansible debsrv1 -m package -a "name=acl state=present" -b -K
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-09T18:29:24Z

Tim: /* prepare a client for ansible usage */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

=== additional useful packages on (debian) clients ===
ansible debsrv1 -m package -a "name=acl state=present" -b -K
ansible debsrv1 -m package -a "name=python state=present" -b -K

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-09T18:24:50Z

Tim: /* Change setting: remove (deprecated) settings in config file only on specific os versions */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>
== use case install package ==
Install package "acl":
ansible debsrv1 -m package -a "name=acl state=present" -b -K

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T16:03:38Z

Tim: /* Change setting: remove (deprecated) settings in config file only on specific os versions */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~$ cat test.conf
abc=123
pfad=44
xcd=77

tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

tim@spike-vm:~$ cat test.conf
abc=123
# removed deprecated config line "pfad=44"
xcd=77

playbook:
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T16:01:47Z

Tim: /* Change setting: remove (deprecated) settings in config file, on specific os version */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file only on specific os versions ===
tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T16:01:12Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
=== Add alias in .bashrc ===
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

=== Add new user "newuser" to sudo group ===
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

=== Change setting: remove (deprecated) settings in config file, on specific os version ===
tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T15:59:54Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add alias in .bashrc
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

Add new user "newuser" to sudo group:
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

Change setting: remove (deprecated) settings in config file, on specific os version:
tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T15:59:25Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add alias in .bashrc
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

Add new user "newuser" to sudo group:
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

Change setting: remove (deprecated) settings in config file:
tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"
<pre>
tim@spike-vm:~$ cat /home/tim/ansi/comment-out-lines.yml
---

# expects variable regex to contain the string that matches the start of the config line
# expects variable path to contain the filename
# limited to debian version >= 9
- hosts: all
become: yes
tasks:

- name: comment out config line
lineinfile:
backup=yes
state=present
path={{ path }}
regexp='^({{ regex }}.*)'
backrefs=yes
line='# removed deprecated config line "\1"'
when: >
ansible_distribution == 'Debian'
and
ansible_lsb.major_release|int >= 9
tim@spike-vm:~$
</pre>

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T15:55:50Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add alias in .bashrc
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

Add new user "newuser" to sudo group:
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

Change setting: remove (deprecated) settings in config file:
tim@spike-vm:~/ansi$ ansible-playbook -l debians /home/tim/ansi/comment-out-lines.yml -K -e "path=test.conf regex='pfad'"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T13:16:26Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add alias in .bashrc
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

Add new user "newuser" to sudo group:
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

Change setting: remove deprecated settings in /etc/ssh/sshd_config file:
ansible target-hostname -m lineinfile -a "state=absent backup=yes path=/etc/ssh/sshd_config regexp='^(ServerKeyBits.*)'" -K -b

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T13:07:58Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add alias in .bashrc
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

Add new user "newuser" to sudo group:
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

Change setting: remove deprecated settings in /etc/ssh/sshd_config file:
ansible "target host" -m lineinfile -a "backrefs=yes backup=yes dest=/etc/ssh/sshd_config regexp='^(ServerKeyBits.*)' line='# tmp, 2018-12-02, removed deprecated config line: \1'" -K -b

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-12-02T13:05:17Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add alias in .bashrc
ansible "target host" -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

Add new user "newuser" to sudo group:
ansible "target host" -m lineinfile -a "backrefs=yes dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"

Change setting: remove deprecated settings in /etc/ssh/sshd_config file:
ansible "target host" -m lineinfile -a "dest=/etc/ssh/sshd_config regexp='^(ServerKeyBits.*)' line='# tmp, 2018-12-02, removed deprecated config line: \1'" -K -b

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T19:44:37Z

Tim: /* restarrt service */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restart service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T19:38:22Z

Tim: /* prepare a client for ansible usage */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
this can be automated later (with ansible working) using the following adhoc command:
ansible all -m lineinfile -a "dest=/etc/sudoers state=present line='secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"'" -b -K

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restarrt service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T16:42:19Z

Tim: /* ansible ad-hoc commands */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== restarrt service ==
ansible spiegel -m service -a "name=puppet state=restarted" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T16:36:36Z

Tim: /* display os version */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== gather system information ==

=== display os version ===
ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T16:36:25Z

Tim: /* execute commands on remote hosts */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
ansible spiegel -m command -a "checkrestart" -b -K

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T16:35:55Z

Tim: /* ansible ad-hoc commands */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== execute commands on remote hosts ==
=== execute simple command ===
tim@spike-vm:~$ ansible spiegel -m command -a "ls -la"

=== execute command as root via sudo ===
tim@spike-vm:~$ ansible spiegel -m command -a "checkrestart" -b -K

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T16:20:39Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <target> -m lineinfile -a "dest=/home/tim/.bashrc create=yes state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T16:16:54Z

Tim: /* use case edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
Add new user "newuser" to sudo group:
ansible <target> -m lineinfile -a "dest=/etc/group regexp='^(sudo:x:27:)(.*)' line='\1newuser,\2'"
Add alias in .bashrc
ansible <traget> -m lineinfile -a "dest=/home/tim/.bashrc state=present line='alias ll=\'ls -l\''"

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-21T15:27:36Z

Tim: /* use case append to file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case add public key to authorized_keys ==
ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-20T21:16:51Z

Tim: /* use case install apt package */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: "{{ package }}"
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-20T21:15:03Z

Tim: /* reboot / restart services that need it */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===
For use of checkrestart, install package:
sudo apt install needrestart

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-20T21:14:25Z

Tim: /* prepare a client for ansible usage */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL
make sure root path is set correctly when executing command via sudo:
grep secure_path /etc/sudoers
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-20T20:28:47Z

Tim: /* use case gather system information */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== gather system information ==

=== display os version ===
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T22:20:26Z

Tim: /* update and upgrade packages */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== reboot / restart services that need it ===

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:46:20Z

Tim: /* ansible playbooks */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= simple ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:45:08Z

Tim: /* Change password for your own user on all targets */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:44:08Z

Tim: /* use cases edit file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use case edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== Change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:43:55Z

Tim: /* use cases append to file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use case append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use cases edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== Change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:43:42Z

Tim: /* use cases add file */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use case add file ==

== use cases append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use cases edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== Change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:43:23Z

Tim: /* ansible playbooks */

= ansible first steps =

== documentation ==
* https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html
* changing root passwords: https://www.redpill-linpro.com/sysadvent/2017/12/02/ansible-change-passwords.html

== installation ==
=== on ubuntu >= 18.04 ===
sudo apt install ansible

=== on ubuntu older than 18.04 and debian (up to 9/stretch) ===
These systems ship with ansible versions older than 2.4. For apt module to work smoothly (e.g. autoremove) we really should have ansible 2.4 or above.

<pre>
sudo echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" >> /etc/apt/sources.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
sudo apt update
sudo apt upgrade
sudo apt install ansible
</pre>

== prepare a client for ansible usage ==
using user tim for ssh sessions, setting user up for sudo, ssh pub key auth

as root user
useradd -m tim -s /bin/bash
passwd tim
add user to sudo group
grep sudo /etc/group
sudo:x:<id>:tim
allow sudo group to use all commands via sudo
grep sudo /etc/sudoers
%sudo ALL=(ALL:ALL) ALL

from here in user context
su - tim
mkdir /home/tim/.ssh
chmod 700 /home/tim/.ssh
echo "<ssh-public-key>" >> /home/tim/.ssh/authorized_keys
chmod 600 /home/tim/.ssh/authorized_keys

== initial ansible serverconfig ==
=== fill /etc/ansible/hosts ===
add all your hosts/groups to your /etc/ansible/hosts file

=== setup ssh shell ===

tim@spike-vm:~/ansi$ ssh-agent bash
tim@spike-vm:~/ansi$ ssh-add /home/tim/.ssh/id_rsa
Enter passphrase for /home/tim/.ssh/id_rsa:
Identity added: /home/tim/.ssh/id_rsa (/home/tim/.ssh/id_rsa)
tim@spike-vm:~/ansi$

or better:
sudo apt install keychain
echo "eval `keychain --eval id_rsa`" >>/home/tim/.bashrc

=== test client connectivity ===

tim@spike-vm:~/ansi$ ansible itchy -m ping
itchy | SUCCESS => {
"changed": false,
"ping": "pong"
}
tim@spike-vm:~/ansi$

=== Logging ===
Ansible has built-in support for logging. Add the following lines to your ansible configuration file:

[defaults]
log_path=/var/log/ansible.log

and then run
tim@spike-vm:~$ sudo touch /var/log/ansible.log
tim@spike-vm:~$ sudo chmod 666 /var/log/ansible.log

This simply logs the command line output to the file

=== Debugging ===

Use -v switch to see playbook stdout:
<pre>
tim@spike-vm:~$ ansible-playbook ansi/update-upgrade.yml -K -v
Using /etc/ansible/ansible.cfg as config file
SUDO password:
/etc/ansible/hosts did not meet host_list requirements, check plugin documentation if this is unexpected
/etc/ansible/hosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [all] *******************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************
ok: [itchy]
...
TASK [.deb do dist-upgrade] **************************************************************************************************************************
ok: [gware] => {"changed": false, "msg": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stderr": "", "stderr_lines": [], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\n0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded."]}
</pre>

= ansible ad-hoc commands =

== use case gather system information ==

display os version:
tim@spike-vm:~$ ansible all -m setup -a "filter=ansible_lsb"

== use cases add file ==
== use cases append to file ==

e.g. add public key to authorized_keys

ansible all -m authorized_key -a "user=tim key='ssh-rsa AAAA...XXX == tim@hostname'"

== use cases edit file ==
ansible all -m lineinfile -a "dest=/etc/group regexp='^(users:x:100:)(.*)' line='\1ldapusername,\2

= ansible playbooks =

== use cases debian/ubuntu sys management using apt ==

=== update and upgrade packages ===
tim@spike-vm:~/ansi$ cat apt-update-upgrade.yml
<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: .deb do dist-upgrade
apt: >
update_cache=yes
cache_valid_time=1200
upgrade=dist
autoremove=yes
purge=yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== autoremove unused packages ===
This only works for ansible >=2.4.

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-autoremove.yml -K

tim@spike-vm:~/ansi$ cat apt-autoremove.yml

<pre>
---

- hosts: all
become: yes
tasks:
- name: assert ansible version
assert:
that:
- "{{ ansible_version.string is version_compare('2.4', '>=') }}"
msg: Ansible 2.4 or above is required
- name: Autoremove unused packages
apt:
autoremove: yes
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'
</pre>

=== use case install apt package ===

tim@spike-vm:~/ansi$ ansible-playbook -l puppet apt-install.yml -K -e "package=apache2"
SUDO password:

PLAY [all] *********************************************************************

TASK [setup] *******************************************************************
ok: [puppet]

TASK [install package "apache2"] ***********************************************
ok: [puppet]

PLAY RECAP *********************************************************************
puppet : ok=2 changed=0 unreachable=0 failed=0

tim@spike-vm:~/ansi$ cat apt-install.yml
---

- hosts: all
become: yes
tasks:
- name: install package "{{ package }}"
apt:
name: apache2
when: >
ansible_distribution == 'Debian'
or
ansible_distribution == 'Ubuntu'

== use case change passwords for linux systems ==

To make password encryption work:
apt install python-passlib

=== Change password for your own user on all targets ===
<pre>
tim@spike-vm:~/ansi$ ansible-playbook change-user-password.yml -l spike -K
SUDO password:
Enter New Password:
confirm Enter New Password:

PLAY [all] ******************************************************************************************************************************

TASK [Gathering Facts] ******************************************************************************************************************
ok: [spike]

TASK [Change password of calling user] **************************************************************************************************
changed: [spike]

PLAY RECAP ******************************************************************************************************************************
spike : ok=2 changed=1 unreachable=0 failed=0

tim@spike-vm:~/ansi$
</pre>
playbook:
<pre>
tim@spike-vm:~/ansi$ cat change-user-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of calling user
user: name={{ lookup('env', 'USER') }} update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

=== change root password ===

<pre>
tim@spike-vm:~/ansi$ cat change-root-password.yml
---
- hosts: all
become: yes
gather_facts: yes

vars_prompt:
- name: "new_password"
prompt: "Enter New Password"
private: yes
encrypt: "sha512_crypt"
confirm: yes
salt_size: 7

tasks:
- name: Change password of root user
user: name=root update_password=always password={{new_password}}
tim@spike-vm:~/ansi$
</pre>

call with:
tim@spike-vm:~/ansi$ ansible-playbook change-root-password.yml -l puppet -K

= ansible advanced topics =

== use case add firewall rule ==

=== iptables ===

=== check point R80 API ===

Ansible Howto

2018-11-19T21:42:39Z

Tim: /* use case gather system information */