- \n
- 2 or more Ubuntu 18.04 Servers<\/li>\n
- \n
- 10.0.15.10\u00a0\u00a0\u00a0\u00a0\u00a0 control-machine<\/li>\n
- 10.0.15.21\u00a0\u00a0\u00a0\u00a0\u00a0 ansi01<\/li>\n
- 10.0.15.22\u00a0\u00a0\u00a0\u00a0\u00a0 ansi02<\/li>\n<\/ul>\n
- Root privileges<\/li>\n<\/ul>\n
What we will do?<\/h2>\n
- \n
- Setup Ansible Control Machine<\/li>\n
- Define User and SSH Key<\/li>\n
- Create Inventory File<\/li>\n
- Create Ansible Playbook<\/li>\n
- Deploy Server Using Playbook<\/li>\n
- Testing<\/li>\n<\/ol>\n
Step 1 – Setup Ansible Control Machine<\/h2>\n
In this tutorial, we will be using the Ubuntu 16.04 servers as the Ansible ‘Machine Control’ and ansible hosts. The first step we need to do is to set up the ‘control machine’.<\/p>\n
We will install python and ansible on the ansible ‘control machine’ by running the following command.<\/p>\n
sudo apt install python ansible -y<\/p>\n
![\"Setup](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04.png\" "\\"\\"")
<\/a><\/p>\nAfter the installation is complete, we will add a new system user.<\/p>\n
We will add a new user named ‘provision’ in order to perform server provisioning using Ansible.<\/p>\n
Add new user ‘provision’ and give the user a password.<\/p>\n
useradd -m -s \/bin\/bash provision
passwd provision<\/p>\nNow add the ‘provision’ user for sudo without the password by creating new configuration file under the ‘\/etc\/sudoers.d\/’ using the command below.<\/p>\n
echo\u00a0 -e ‘provision\\tALL=(ALL)\\tNOPASSWD:\\tALL’ > \/etc\/sudoers.d\/provision<\/p>\n
A new user has been created, and now it can use sudo without a password.<\/p>\n
![\"Add](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-1.png\" "\\"\\"")
<\/a><\/p>\nStep 2 – Define User and SSH Key<\/h2>\n
In this step, we will define the user for ansible hosts. This user will be automatically created by ansible, so we just need to define the username, password, and the ssh public key.<\/p>\n
For each server (‘ansi01’ and ‘ansi02’), we will create a new user named ‘provision’ with password ‘secret01’. And we need to encrypt the ‘secret01’ password using the mkpasswd command.<\/p>\n
Encrypt the ‘secret01’ password using the command below.<\/p>\n
mkpasswd –method=SHA-512
TYPE THE PASSWORD ‘secret01’<\/p>\nNote:<\/strong><\/p>\n
Make sure the ‘whois’ package is installed on the system, or you can install using the following command.<\/p>\n
sudo apt install whois -y<\/p>\n
And you will get the SHA-512 encrypted password.<\/p>\n
![\"Define](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-2.png\" "\\"\\"")
<\/a><\/p>\nNext, we will generate a new ssh-key.<\/p>\n
Login to the ‘provision’ user and generate the ssh key using the ssh-keygen command.<\/p>\n
su – provision
ssh-keygen -t rsa<\/p>\nNow the user and password have been defined, and the ssh key has been created l(ocated at the ‘.ssh’ directory).<\/p>\n
![\"user](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-3.png\" "\\"\\"")
<\/a><\/p>\nStep 3 – Create New Inventory<\/h2>\n
In this step, we will define the inventory files for all server hosts.<\/p>\n
Login as the ‘provision’ user and create a new directory for the project.<\/p>\n
su – provision
mkdir -p ansible01\/<\/p>\nGo to the ‘ansible01’ directory and create a new inventory file ‘inventory.ini’ using vim<\/a>.<\/p>\n
cd ansible01\/
vim inventory.ini<\/p>\nPaste the following configuration there.<\/p>\n
[webserver]
Save and exit.<\/p>\n
Now create a new ansible configuration file ‘ansible.cfg’.<\/p>\n
vim ansible.cfg<\/p>\n
Paste the following configuration there.<\/p>\n
[defaults]
Save and exit.<\/p>\n
![\"Create](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-4.png\" "\\"\\"")
<\/a><\/p>\nThe ansible inventory file has been created, and our ansible scripts will be located under the ‘provision’ user, inside the ‘ansible01’ directory.<\/p>\n
Step 4 – Create Ansible Playbook<\/h2>\n
Ansible Playbook is set of instructions that you send to run on a single or group of server hosts. It represents the ansible-provisioning, where the automation is defined as tasks, and all jobs like installing packages, editing files, will be done by ansible modules.<\/p>\n
In this step, we will create a new ansible playbook to deploy a new user, deploy the ssh key, and configure the ssh service.<\/p>\n
Before we create a new ansible playbook, we will scan all server fingerprint using the ssh-keyscan command as below.<\/p>\n
ssh-keyscan 10.0.15.21 >> ~\/.ssh\/known_hosts
ssh-keyscan 10.0.15.22 >> ~\/.ssh\/known_hosts<\/p>\nThose servers fingerprint will be stored at the ‘.ssh\/known_hosts’ file.<\/p>\n
![\"Create](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-5.png\" "\\"\\"")
<\/a><\/p>\nNote:<\/strong><\/p>\n
If you have a lot of server nodes, you can save your host list and then manually scan the ssh key fingerprint using bash script as shown below.<\/p>\n
for i in $(cat list-hosts.txt)
do
ssh-keyscan $i >> ~\/.ssh\/known_hosts
done<\/p>\nNext, create the ansible playbook named ‘deploy-ssh.yml’ using vim.<\/p>\n
vim deploy-ssh.yml<\/p>\n
Paste following the ansible playbook there.<\/p>\n
---
\u00a0 tasks:<\/p>
\u00a0 - name: Add a new user named provision
\u00a0 - name: Add provision user to the sudoers
\u00a0 - name: Deploy SSH Key
\u00a0 - name: Disable Password Authentication
\u00a0 - name: Disable Root Login
\u00a0 handlers:
Save and exit.<\/p>\n
On the playbook script:<\/p>\n
- \n
- we create the ‘deploy-ssh.yml’ playbook script to be applied on all servers defined in the ‘inventory.ini’ file.<\/li>\n
- we create the ansible variable ‘provision_password’, containing the encrypted password for the new user.<\/li>\n
- Set the Ansible facts to ‘no’.<\/li>\n
- Define the ‘root’ user as a remote user to perform tasks automation.<\/li>\n
- We create new tasks for adding a new user, add the user to the sudoers, and upload the ssh key.<\/li>\n
- We create new tasks for configuring the ssh services, disabling the root login, and disable password authentication. Tasks for configuring the ssh will trigger the ‘restart ssh’ handlers.<\/li>\n
- We create a handler to restart the ssh service.<\/li>\n<\/ul>\n
Step 5 – Run the Playbook<\/h2>\n
Login to the ‘provision’ user and go to the ‘ansible01’ directory.<\/p>\n
su – provision
cd ansible01\/<\/p>\nNow run the the ‘deploy-ssh.yml’ playbook using the command as shown below.<\/p>\n
ansible-playbook deploy-ssh.yml –ask-pass<\/p>\n
Type your root password, and you will get the result as below.<\/p>\n
![\"Run](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-6.png\" "\\"\\"")
<\/a><\/p>\nAll tasks for deploying a new user and ssh key have been completed successfully.<\/p>\n
Step 6 – Testing<\/h2>\n
Test using ansible command.<\/p>\n
ansible webserver -m ping
ansible webserver -m shell -a id<\/p>\nNow you will get the green messages as below.<\/p>\n
![\"Testing](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-7.png\" "\\"\\"")
<\/a><\/p>\nNow we can manage those ‘ansi01’ and ‘ansi02’ servers using Ansible, and the ‘provision’ user will be default user for Ansible.<\/p>\n
Testing connection to the servers<\/p>\n
ssh 10.0.15.21
ssh 10.0.15.22<\/p>\nAnd you will be connected to each server using the default key ‘.ssh\/id_rsa’ file, and using the user ‘provision’.<\/p>\n
![\"Test](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-8.png\" "\\"\\"")
<\/a><\/p>\n![\"Another](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-9.png\" "\\"\\"")
<\/a><\/p>\nDeploying new user and ssh-key using ansible has been completed successfully.<\/p>\n
Reference<\/h2>\n
\nShare this page:<\/b><\/p>\n
\n
![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-10.png\" "\\"\\"")
<\/a>
\n![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-11.png\" "\\"\\"")
<\/a>
\n![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-12.png\" "\\"\\"")
<\/a>
\n![\"\"](\"https:\/\/afaghhosting.net\/blog\/wp-content\/uploads\/2018\/05\/setup-new-user-and-ssh-key-auth-using-ansible-on-ubuntu-18-04-13.png\" "\\"\\"")
<\/a>\n<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"Ansible is a simple automation tool that automates software applications deployment, cloud provisioning, and configuration management. It’s a server orchestration tool that helps you to manage and control a large number of server nodes from single places called ‘Control Machines’. Ansible was created by Michael DeHaan in 2012 and is written in Python and Powershell. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-4052","post","type-post","status-publish","format-standard","hentry","category-36"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/4052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=4052"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/4052\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=4052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=4052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=4052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Setup](\"https:\/\/www.howtoforge.com\/images\/setup_new_user_and_ssh_key_authentication_using_ansible\/big\/2.png\" "\\"\\"")
<\/a><\/p>\n