Ansible

ansible

Сервер

Установка

apt install ansible

Создать файл с настройками

# Создать файл инвентаря в /etc/ansible/hosts
# Например vi /etc/ansible/hosts

[data]                      # группа хостов
192.168.40.1 hostname=Dev1  # ip хоста + переменная hostname
192.168.40.2 hostname=Dev2

# Посмотреть хосты
ansible -i /ansible/deploy/deploy all --list-hosts

# vi /ansible/deploy/ansible.cfg
 
[defaults]
inventory = /ansible/deploy/deploy
remote_user = root
 
# чтобы выполнять скрипт с определенного пользователя 
[privilege_escalation]
become = true
become_method = sudo
become_user = root
become_ask_pass = true

Теперь если находится в папке /ansible/deploy будет работать команда ansible all —list-hosts

Hoc command

команды которые используются один раз ( без файла если проще )

ansible host-pattern -m module [-a 'module arguments'] [-i inventory] -u root

• host-pattern - что за хост (all, группа, определенный хост)
• -m module - что сделать (ping, command)
• -a - аргументы для -m
• -i - если нужно указать файл с хостами
• -u - указывает удаленного пользователя

мануал по командам

ansible-doc ping

Playbook

1 Базовая настройка

- hosts: all                # Все хосты в этой инвентаре 
  tasks:                    # задаем задачи
  - name: Hostname          # имя задачи (обязательно)
    hostname:               # задача hostname ()
      name: "{{hostname}}"  # задаем name по переменной hostname из инвентаря
  - name: timezone           
    timezone:               # задача timezone
      name: Europe/Moscow

2 Настройка Nftables

# Вписывает в переменную nft_output значение команды nft list ruleset
# и проверяет что там нет "policy drop", если есть, то пропускает
---
# script give firewale
---
- name: Check nftables policy
  hosts: all
  tasks:
    # copy /etc/nftables.conf
    - name: upload nftables.conf
      copy:
        dest: /etc/nftables.conf
        src: /etc/nftables.conf
      notify: upload
        # upload /etc/nftables.conf in firewale
    - name: enable nft
      service:
        name: nftables
        enabled: yes
  handlers:
    - name: upload
      service:
        name: nftables
        state: restarted

3 Сайт на apache2

# Скачивает apache2, создает директорию с сайтом, удаляет 000-default.conf, копирует site.conf, restarted
---
- name: create website
  hosts: all
  tasks:
    # download apache2
    - name: download apache2
      package:
        name: apache2
    # create file
    - name: create index.html
      block:
        # create folder
        - name: create directory
          file:
            path: /var/www/site
            state: directory
        # create index.html
        - name: create file
          copy:
           dest: /var/www/site/index.html
           content: |
              <i>Linux - Because there is more than one way. <br>
              This site was served by <b> "{{hostname}}" </b> </i>
          notify: restart
    # delete default site
    - name: delete default site
      file:
        path: /etc/apache2/sites-enabled/000-default.conf
        state: absent
      notify: restart
    # copy site.conf
    - name: upload site.conf
      template:
        src: /share/site.conf
        dest: /etc/apache2/sites-enabled/
      notify: restart
  handlers:
    - name: restart
      service:
        name: apache2
        state: restarted

4 FTP

---
#create ftp server
- name: create ftp server
  hosts: all
  tasks:
    # download vsftpd
    - name: download vsftpd
      package:
        name: vsftpd
      notify: restart
    # create user
    - name: create user webmaster
      user:
        name: webmaster
        home: /var/www
        password: $y$j9T$YHmVShL2L7MQo3xdqXGgG1$qebrPw/bI3kQcTe/w4OfYp432rtRBtQ.FWfacJbOAy4
      notify: restart
    - name: CA
      block:
          copy:
            src: /ca/
            dest: /ca/
        - name: mv ca
          block:
            - name: SubCA.crt
              copy:
                src: /ca/SubCA.crt
                dest: /usr/local/share/ca-certificates/
            - name: ca.crt
              copy:
                src: /ca/ca.crt
                dest: /usr/local/share/ca-certificates/
      notify: update ca
    - name: copt list.vsftp
      copy:
        src: /etc/list.vsftp
        dest: /etc/list.vsftp
      notify: restart
    - name: copy vsftpd.conf
      copy:
        src: /etc/vsftpd.conf
        dest: /etc/vsftpd.conf
      notify: restart
    - name: chown
      file:
        path: /var/www
        owner: www-data
 
  handlers:
    - name: restart
      service:
        name: vsftpd
        state: restarted
    - name: update ca
      command: "update-ca-certificates"

Пример vsftpd.conf Создание hash пароля

5 HAPROXY

---
#create HAPROXY
- name: create ha server
  hosts: all
  tasks:
    # download haproxy and vrrp
    - name: dowload
      block:
        - name: copy /etc/apt/sources.list
          copy:
            src: /etc/apt/sources.list
            dest: /etc/apt/sources.list
        - name: apt update
          apt:
            update_cache: yes
        - name: download haproxy
          package:
           name: haproxy
        - name: download keepalived
          package:
            name: keepalived
 
    # create CA
    - name: CA
      block:
        - name: copy crt
          copy:
            src: /ca/
            dest: /ca/
        - name: mv ca
          block:
            - name: SubCA.crt
              copy:
                src: /ca/SubCA.crt
                dest: /usr/local/share/ca-certificates/
            - name: ca.crt
              copy:
                src: /ca/ca.crt
                dest: /usr/local/share/ca-certificates/
      notify: update ca
 
 
    # template
    - name: template
      block:
        - name: template keepalived
          template:
            src: /share/keepalived
            dest: /etc/keepalived/keepalived.conf
          notify: restart keepalived
        - name: template haproxy
          template:
            src: /share/haproxy
            dest: /etc/haproxy/haproxy.cfg
          notify: restart haproxy
        - name: sysctl
          sysctl:
            name: net.ipv4.ip_nonlocal_bind
            value: 1
            sysctl_set: yes
            state: present
            reload: yes
          notify: restart haproxy
 
 
    # restart and update ca
  handlers:
    - name: restart keepalived
      service:
        name: keepalived
        state: restarted
    - name: restart haproxy
      service:
        name: haproxy
        state: restarted
    - name: update ca
      command: "update-ca-certificates"

2 Настройка Nftables Вариант с проверкой

# Вписывает в переменную nft_output значение команды nft list ruleset
# и проверяет что там нет "policy drop", если есть, то пропускает
 
---
- name: Check nftables policy
  hosts: all
  tasks:
    - name: Get nftables ruleset
      ansible.builtin.command: nft list ruleset
      register: nft_output
      changed_when: false
 
    - name: Check if policy drop is set
      block:
        - name: copy
          template:
            src: /etc/nftables.conf
            dest: /etc/nftables.conf
        - name: upload
          command: nft -f /etc/nftables.conf
      when: " not 'policy drop' in nft_output.stdout"

Модули ansible команд

Module category	Modules
Files modules	- copy: Copy a local file to the managed host - file: Set permissions and other properties of files - lineinfile: Ensure a particular line is or is not in a file - synchronize: Synchronize content using rsync
Software package modules	- package: Manage packages using autodetected package manager native to the operating system - yum: Manage packages using the YUM package manager - apt: Manage packages using the APT package manager - dnf: Manage packages using the DNF package manager - gem: Manage Ruby gems - pip: Manage Python packages from PyPI
System modules	- firewalld: Manage arbitrary ports and services using firewalld - reboot: Reboot a machine - service: Manage services - user: Add, remove, and manage user accounts
Net Tools modules	- get_url: Download files over HTTP, HTTPS, or FTP - nmcli: Manage networking - uri: Interact with web services

Пример vsftpd.conf

# параметры по умолчанию
listen=NO
listen_ipv6=YES
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
 
# запретить анонимным пользователям заходить в ftp
anonymous_enable=NO
 
# Виртуальные пользователи будут использовать те же права, что и локальные пользователи. (Иначе гости не могут создавать)
virtual_use_local_privs=YES
# все действия пользователя будут от гостя ( www-data )
guest_enable=YES
guest_username=www-data
 
# доступ локальным пользователям, запись, заменить каталог по умолчанию "/" на домашний, и какая-то команда без которой не работает 
local_enable=YES
write_enable=YES
chroot_local_user=YES
allow_writeable_chroot=YES
 
# сертификаты 
rsa_cert_file=/ca/ftp.crt
rsa_private_key_file=/ca/ftp.key
ssl_enable=NO
 
# Пассивный режим
pasv_enable=YES
pasv_max_port=2100
pasv_min_port=2000
 
# Разрешить вход пользователям только из списка
# userlist_deny и userlist_enable, почему-то обязяательны. т.е без одного из них другой не работает.
userlist_deny=NO
userlist_enable=YES
userlist_file=/etc/list.vsftp
 
# пример файла cat /etc/list.vsftp. в нем перечислены пользователи которым разрешен доступ 
webmaster

Создание hash пароля

apt install whois
mkpasswd >> yml/4-ftp.yml

Ansible

--> /etc/ansible/hosts
==========================================
	[BR]
	10.2.30.50 Hostname=BR-CL 
==========================================
	
--> /ansible/deploy/ansible.cfg
==========================================
[defaults]
inventory = /etc/ansible/hosts
remote_user = root
==========================================

vi /ansible/yml/1-basic.yml

- name: Basic configuration
  hosts: BR
  tasks:
    - name: copy apt
      copy:
        src: /ansible/conf/sources.list
        dest: /etc/apt/
    - name: apt update
      apt:
        update-cache: yes
    - name: Hostname
      hostname:
        name: "{{Hostname}}"
    - name: Timezone
      timezone:
        name: Europe/Copenhagen
    - name: NTP
      copy:
        src: /ansible/conf/timesyncd.conf
        dest: /etc/systemd/
      notify: timesyncd
 
  handlers:
    - name: timesyncd
      service:
        name: systemd-timesyncd
        state: restarted

--> /ansible/conf/timesyncd.conf
==========================================
	[Time]
	NTP=10.2.30.1
==========================================
 
--> /ansible/conf/sources.list
==========================================
	deb [trusted=yes] <http://deb.debian.org/debian> bookworm main contrib
==========================================

vi /ansible/yml/2-syslog.yml

- name: rsyslog
  hosts: BR
  tasks:
    - name: install
      apt:
        name: rsyslog
    - name: copt conf
      copy:
        src: /ansible/conf/rsyslog.conf
        dest: /etc/
      notify: restart
 
  handlers:
    - name: restart
      service:
        name: rsyslog
        state: restarted

--> /ansible/conf/rsyslog.conf
==========================================
	*.*;auth,authpriv.none          @10.2.10.11
==========================================

vi /ansible/yml/3-snmp.yml

- name: snmpd
  hosts: BR
  tasks:
    - name: install
      apt:
        name: snmpd
    - name: copy conf
      copy:
        src: /ansible/conf/snmpd.conf
        dest: /etc/snmp/
      notify: restart
 
  handlers:
    - name: restart
      service:
        name: snmpd
        state: restarted
 

 
--> /ansible/conf/snmpd.conf
==========================================
	view   systemonly  included   .1
==========================================

vi /ansible/yml/4-ldap.yml

- name: ldap
  hosts: BR
  tasks:
    - name: install
      apt:
        name: libpam-ldapd
    - name: copy nsswitch.conf
      copy:
        src: /ansible/conf/nsswitch.conf
        dest: /etc/
 
    - name: nslcd
      copy:
        dest: /etc/nslcd.conf
        content: |
          uid nslcd
          gid nslcd
          uri ldap://10.1.10.11
          base dc=lego,dc=dk
      notify: restart nslcd
 
    - name: pam homedir
      copy:
        src: /ansible/conf/common-session
        dest: /etc/pam.d/
 
  handlers:
    - name: restart nslcd
      service:
        name: nslcd
        state: restarted

--> /ansible/conf/nsswitch.conf
==========================================
	passwd:         files systemd ldap
	group:          files systemd ldap
	shadow:         files systemd ldap
==========================================

vi /ansible/yml/5-share.yml

- name: ldap
  hosts: BR
  tasks:
    - name: install libpam-mount
      apt:
        name: libpam-mount
    - name: install cifs-utils
      apt:
        name: cifs-utils
 
    - name: copy pam_mount.conf.xml
      copy:
        src: /ansible/conf/pam_mount.conf.xml
        dest: /etc/security/

--> /ansible/conf/pam_mount.conf.xml
==========================================
	<volume
        fstype="cifs"
        server="ldap.lego.dk"
        path="users"
        mountpoint="/share/users/%(USER)"
        options="uid=%(USER)"
        />
==========================================

vi /ansible/yml/6-webserver.ym

- name: create website
  hosts: BR
  tasks:
    - name: install apache2
      apt:
        name: apache2
 
    - name: create diretory
      file:
        path: /var/www/site
        state: directory
 
    - name: create index.html
      copy:
        dest: /var/www/site/index.html
        content: Website of "{{Hostname}}"
      notify: restart
 
    - name: deleate defauly page
      file:
        path: /etc/apache2/sites-enabled/000-default.conf
        state: absent
      notify: restart
 
    - name: site.conf
      copy:
        dest: /etc/apache2/sites-enabled/site.conf
        content: |
          <VirtualHost *:80>
          ServerName BR-CL.hearning.lego.dk
          DocumentRoot /var/www/site
          </VirtualHost>
      notify: restart
 
  handlers:
    - name: restart
      service:
        name: apache2
        state: reloaded