WEBVTT

1
00:00.000 --> 00:04.120
So friends, to kick us off, what I first want to do is to walk through some

2
00:04.120 --> 00:04.680
basic

3
00:04.680 --> 00:09.140
AC Lennox configuration that is ultimately going to allow us to access a web

4
00:09.140 --> 00:09.680
server.

5
00:09.680 --> 00:13.880
Now what I want to do first is just to walk through the process manually so

6
00:13.880 --> 00:14.080
that you're

7
00:14.080 --> 00:18.110
very, very clear as to what is going on because quite simply, if you just look

8
00:18.110 --> 00:18.960
at the resultant

9
00:18.960 --> 00:23.360
playbook that we're going to be writing to configure this, well, it is quite

10
00:23.360 --> 00:23.760
easy to

11
00:23.760 --> 00:24.920
get lost in the woods.

12
00:24.920 --> 00:27.480
AC Lennox can be a little bit confusing.

13
00:27.480 --> 00:31.110
So if you see exactly what you're trying to do manually, you will be much more
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.480 --> 00:31.110
So if you see exactly what you're trying to do manually, you will be much more

14
00:31.110 --> 00:31.520
easily

15
00:31.520 --> 00:35.320
able to map what it is we have to do in the playbook and it should make more

16
00:35.320 --> 00:35.880
sense.

17
00:35.880 --> 00:40.690
So what we're going to be doing is installing an HTTP server and ultimately

18
00:40.690 --> 00:41.600
this server

19
00:41.600 --> 00:45.120
is going to, well, serve up a very particular web page.

20
00:45.120 --> 00:48.770
Now as it transpires, the actual configuration that we're going to invoke is

21
00:48.770 --> 00:49.400
going to run

22
00:49.400 --> 00:53.740
into some problems because of AC Lennox configuration and then we're going to

23
00:53.740 --> 00:54.960
see how we can actually

24
00:54.960 --> 00:58.510
solve those issues and like I say, once we've done that, we'll map it to an Ans

25
00:58.510 --> 00:59.360
ible Playbook

26
00:59.360 --> 01:01.600
and begin automating the process.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.360 --> 01:01.600
and begin automating the process.

27
01:01.600 --> 01:05.830
This is actually a really good way to begin building out complex Ansible Blue

28
01:05.830 --> 01:06.440
Books.

29
01:06.440 --> 01:10.360
So with that said, let's go and walk through what we've got to do here.

30
01:10.360 --> 01:13.040
So here I am over on my Blue Box.

31
01:13.040 --> 01:17.030
The very first thing that I'm going to do before I even begin is to turn off my

32
01:17.030 --> 01:17.560
firewall

33
01:17.560 --> 01:18.920
configuration.

34
01:18.920 --> 01:22.320
That is because the firewall is going to present some problems.

35
01:22.320 --> 01:25.590
Now the good news is that later on within this very scale, we'll be talking

36
01:25.590 --> 01:26.280
about how we

37
01:26.280 --> 01:29.920
can actually use firewall D via automation.

38
01:29.920 --> 01:33.020
So realistically, we'll get to see how this is actually solved in the real
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:29.920 --> 01:33.020
So realistically, we'll get to see how this is actually solved in the real

39
01:33.020 --> 01:33.440
world.

40
01:33.440 --> 01:36.360
But for now, let's just keep things as simple as possible.

41
01:36.360 --> 01:38.720
After all, AC Lennox is complex enough.

42
01:38.720 --> 01:44.950
So all I will do is I will just say pseudo systemctl stop firewall D and to

43
01:44.950 --> 01:45.920
enter.

44
01:45.920 --> 01:48.760
I'll now type in my password for the super user.

45
01:48.760 --> 01:53.530
And now if I say systemctl status on firewall D, as we can see here, the

46
01:53.530 --> 01:55.160
service has stopped.

47
01:55.160 --> 01:56.160
Perfect.

48
01:56.160 --> 01:57.720
That's the first thing that we want to be doing.

49
01:57.720 --> 02:02.920
So the next thing that I want to do is I want to install my HTTP server on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:57.720 --> 02:02.920
So the next thing that I want to do is I want to install my HTTP server on the

50
02:02.920 --> 02:03.720
system.

51
02:03.720 --> 02:08.280
So I will just say it's pseudo DNF install, HTTP D and hit enter.

52
02:08.280 --> 02:10.760
We'll begin pulling down the information.

53
02:10.760 --> 02:12.000
Just give it a moment.

54
02:12.000 --> 02:14.590
And now we can see all of the additional dependencies that are going to be

55
02:14.590 --> 02:15.200
installed.

56
02:15.200 --> 02:17.400
Let's just hit Y and hit enter.

57
02:17.400 --> 02:19.720
Now let's just give this a moment to complete.

58
02:19.720 --> 02:22.640
And as we can see here now, we have installed everything.

59
02:22.640 --> 02:28.640
So as it stands at the moment, if I just say systemctl status on 80 DPD, notice

60
02:28.640 --> 02:29.440
the status

61
02:29.440 --> 02:31.280
is inactive and dead.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.440 --> 02:31.280
is inactive and dead.

62
02:31.280 --> 02:36.490
So what I will do here is I will say pseudo systemctl start 80 DPD and just

63
02:36.490 --> 02:37.240
give this

64
02:37.240 --> 02:39.200
a few seconds to load up.

65
02:39.200 --> 02:42.890
Now if we check the status, as we can see here, the server is active and

66
02:42.890 --> 02:43.640
running.

67
02:43.640 --> 02:48.040
So what I can do is if I just say IP adder and get my IP address here, this is

68
02:48.040 --> 02:48.920
my IP address.

69
02:48.920 --> 02:50.920
Let's just copy this for the moment.

70
02:50.920 --> 02:55.450
And if I go to my web browser, all I will do is I'll paste in the IP address

71
02:55.450 --> 02:56.000
and hit

72
02:56.000 --> 03:00.160
enter and we land on the Red Hat Enterprise Linux test page.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:56.000 --> 03:00.160
enter and we land on the Red Hat Enterprise Linux test page.

73
03:00.160 --> 03:04.760
Pretty much this page is telling us if we happen to have installed an HTTP

74
03:04.760 --> 03:04.960
server, this

75
03:04.960 --> 03:07.840
means that the HTTP service is installed.

76
03:07.840 --> 03:09.840
Okay, that is working correctly.

77
03:09.840 --> 03:10.840
Perfect.

78
03:10.840 --> 03:16.780
Let's say we want to have a custom location whereby our site is going to serve

79
03:16.780 --> 03:17.720
up content.

80
03:17.720 --> 03:21.880
Now by default, if I just go back to my terminal right here, I think we'll

81
03:21.880 --> 03:22.800
screen and I go

82
03:22.800 --> 03:26.550
into a very particular configuration file, so I'll say pseudo them and I'll go

83
03:26.550 --> 03:27.080
into the

84
03:27.080 --> 03:31.620
Etsy directory and then 80 DPD and then the conf directory and then a fail
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:27.080 --> 03:31.620
Etsy directory and then 80 DPD and then the conf directory and then a fail

85
03:31.620 --> 03:33.240
called 80 DPD

86
03:33.240 --> 03:34.240
dot conf.

87
03:34.240 --> 03:35.240
Let's go in here.

88
03:35.240 --> 03:36.240
Okay.

89
03:36.240 --> 03:38.520
Now if I scroll all the way down, just keep on going.

90
03:38.520 --> 03:41.880
We'll see a whole bunch of configurations and then we'll come to this portion

91
03:41.880 --> 03:42.240
right

92
03:42.240 --> 03:43.240
here.

93
03:43.240 --> 03:47.720
Now as it stands, what it actually tells us here is that the document route is

94
03:47.720 --> 03:48.160
in the

95
03:48.160 --> 03:52.440
var directory and then www and then HTML.

96
03:52.440 --> 03:56.480
This is where we expect to effectively house our configuration files.

97
03:56.480 --> 04:01.210
So if you want to put in an index page, which would be your homepage index dot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:56.480 --> 04:01.210
So if you want to put in an index page, which would be your homepage index dot

98
04:01.210 --> 04:01.840
HTML, pretty

99
04:01.840 --> 04:06.480
much the server is set up to look in this particular directory for this

100
04:06.480 --> 04:07.960
particular file

101
04:07.960 --> 04:11.840
and as we can see here, we have some particular configurations relating to

102
04:11.840 --> 04:12.920
these directories

103
04:12.920 --> 04:15.600
within the var www directory.

104
04:15.600 --> 04:20.050
We have some configs right here allowing access as well as into the HTML file

105
04:20.050 --> 04:20.800
directly or

106
04:20.800 --> 04:25.280
rather the HTML directory directly a little bit of a tongue twister.

107
04:25.280 --> 04:29.070
We also have some configurations again, if you scroll on down, we can see here

108
04:29.070 --> 04:29.520
we're

109
04:29.520 --> 04:34.140
granting everyone access to this particular directory or rather the contents
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:29.520 --> 04:34.140
granting everyone access to this particular directory or rather the contents

110
04:34.140 --> 04:34.720
within that

111
04:34.720 --> 04:35.720
directory.

112
04:35.720 --> 04:39.440
So what we want to do is we want to have a custom directory and not actually

113
04:39.440 --> 04:40.600
follow that particular

114
04:40.600 --> 04:41.600
directory structure.

115
04:41.600 --> 04:46.970
Now what I want to show you here is by default, when we happen to just install

116
04:46.970 --> 04:48.400
HTTP, some security

117
04:48.400 --> 04:51.200
context labels are already going to be set for us.

118
04:51.200 --> 04:56.530
So if I go into the var directory and then www, if I do an LS and then dash

119
04:56.530 --> 04:57.360
capital Z

120
04:57.360 --> 05:01.560
to show the security context attached to this particular directory, we have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:57.360 --> 05:01.560
to show the security context attached to this particular directory, we have

121
05:01.560 --> 05:02.480
this particular

122
05:02.480 --> 05:07.760
type here, the HTTP underscore sys underscore content underscore T.

123
05:07.760 --> 05:12.570
What this is pretty much telling us here is that the HTTP process can access

124
05:12.570 --> 05:13.240
content

125
05:13.240 --> 05:15.600
within this particular directory.

126
05:15.600 --> 05:18.360
What we want to do is you want to have our own custom directory.

127
05:18.360 --> 05:22.120
So all I will do here is I will make a directory, let's just say pseudo, MKDAR,

128
05:22.120 --> 05:22.760
and let's just

129
05:22.760 --> 05:24.040
call this my site.

130
05:24.040 --> 05:25.040
Okay.

131
05:25.040 --> 05:30.350
Now if I go into my sites and I just say pseudo vim and I create an index dot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:25.040 --> 05:30.350
Now if I go into my sites and I just say pseudo vim and I create an index dot

132
05:30.350 --> 05:31.000
HTML right

133
05:31.000 --> 05:35.840
here and inside of here, I would just say this as the blue box website.

134
05:35.840 --> 05:36.840
Okay.

135
05:36.840 --> 05:38.320
Now there's a problem here.

136
05:38.320 --> 05:43.030
First off, the actual configuration file is not configured to look into this

137
05:43.030 --> 05:43.820
particular

138
05:43.820 --> 05:45.760
directory for this particular file.

139
05:45.760 --> 05:48.320
So that's the first thing we want to be fixing there.

140
05:48.320 --> 05:49.320
Okay.

141
05:49.320 --> 05:50.920
So what I will do here is I'll go and I'll say pseudo vim.

142
05:50.920 --> 05:55.380
I'll go into the exit directory once again, 80dPD, and then the cons directory

143
05:55.380 --> 05:55.960
and then

144
05:55.960 --> 05:57.600
the 80dPD dot conf file.

145
05:57.600 --> 06:01.260
All I'm going to do here is go into insert mode and I'm going to specify that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
05:57.600 --> 06:01.260
All I'm going to do here is go into insert mode and I'm going to specify that

146
06:01.260 --> 06:01.960
the document

147
06:01.960 --> 06:06.480
route is not going to be var www HTML.

148
06:06.480 --> 06:09.200
Instead it's just going to be forward slash my site.

149
06:09.200 --> 06:13.640
And similarly, all I'll do is just comment out this particular part right here.

150
06:13.640 --> 06:17.780
And this directory here, all I will do is I'm going to change this also to my

151
06:17.780 --> 06:18.240
site.

152
06:18.240 --> 06:19.240
Okay.

153
06:19.240 --> 06:21.940
Forward slash my site and all this part here, all these comments, let's just

154
06:21.940 --> 06:22.400
remove all

155
06:22.400 --> 06:23.480
them just for simplicity.

156
06:23.480 --> 06:24.480
Okay.

157
06:24.480 --> 06:25.480
Just delete all these.

158
06:25.480 --> 06:29.170
What we're now doing is we're telling the server to look into this directory

159
06:29.170 --> 06:29.400
for the

160
06:29.400 --> 06:30.640
content of the website.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

160
06:29.400 --> 06:30.640
content of the website.

161
06:30.640 --> 06:34.600
And again, all we've done is just assign some associated configurations that

162
06:34.600 --> 06:36.400
allow for access.

163
06:36.400 --> 06:40.760
So if I just write and quit at the moment, let's maybe try reloading the server

164
06:40.760 --> 06:41.080
.

165
06:41.080 --> 06:42.080
Okay.

166
06:42.080 --> 06:43.640
So just do a restart on 80dPD.

167
06:43.640 --> 06:45.240
Give it a few seconds.

168
06:45.240 --> 06:46.240
Okay.

169
06:46.240 --> 06:47.840
Let's go back to our webpage.

170
06:47.840 --> 06:52.040
Let's type an IP address and we still get the same default page.

171
06:52.040 --> 06:53.040
What is going on here?

172
06:53.040 --> 06:59.050
Even though we've told the HTTP server to look into the my site directory for

173
06:59.050 --> 07:00.280
its contents,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
06:59.050 --> 07:00.280
its contents,

174
07:00.280 --> 07:05.840
we actually are having a problem via SEO Linux and it is explicitly related to

175
07:05.840 --> 07:06.640
the security

176
07:06.640 --> 07:08.000
context labels.

177
07:08.000 --> 07:09.560
So let me go and show you what I mean.

178
07:09.560 --> 07:13.090
If I do an LS and my route directory, we can see all of my doors that I've

179
07:13.090 --> 07:13.960
created here

180
07:13.960 --> 07:15.800
is the my site directory.

181
07:15.800 --> 07:19.530
If I want to see the security context associated, I would just do my dash

182
07:19.530 --> 07:20.480
capital Z and to

183
07:20.480 --> 07:21.480
answer.

184
07:21.480 --> 07:22.760
So look at this right here.

185
07:22.760 --> 07:23.960
Let's look at the third column.

186
07:23.960 --> 07:24.960
Okay.

187
07:24.960 --> 07:30.450
So the associated type is default underscore T. Now recall in order for the 80d
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

187
07:24.960 --> 07:30.450
So the associated type is default underscore T. Now recall in order for the 80d

188
07:30.450 --> 07:31.280
PD process

189
07:31.280 --> 07:35.410
to be able to access this directory, we want this directory to have this

190
07:35.410 --> 07:36.440
particular content

191
07:36.440 --> 07:39.880
80dPD sys content T.

192
07:39.880 --> 07:43.720
So first let me prove to you that SEO Linux is the problem and the way we will

193
07:43.720 --> 07:44.200
do that

194
07:44.200 --> 07:48.730
is by changing SEO Linux to be in permissive mode so that it doesn't actually

195
07:48.730 --> 07:49.920
block anything.

196
07:49.920 --> 07:51.840
It just logs any potential issues.

197
07:51.840 --> 07:56.310
So all I will do here is also pseudo set enforce and I'll change this to per

198
07:56.310 --> 07:57.040
missive.

199
07:57.040 --> 08:01.840
If I now do SE status, we can see the current mode is now permissive.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

199
07:57.040 --> 08:01.840
If I now do SE status, we can see the current mode is now permissive.

200
08:01.840 --> 08:07.150
And because of this, even though we have a mismatch in labels, the 80dPD server

201
08:07.150 --> 08:07.640
is not

202
08:07.640 --> 08:11.240
going to be blocked by SEO Linux and it should be able to consume what we

203
08:11.240 --> 08:13.080
actually have within

204
08:13.080 --> 08:14.480
the my site directory.

205
08:14.480 --> 08:16.720
So let's go back to a browser.

206
08:16.720 --> 08:21.300
Let's open IP address of the server and to enter and now look at this with SE

207
08:21.300 --> 08:21.880
Linux now

208
08:21.880 --> 08:25.280
effectively disabled or at least in permissive mode.

209
08:25.280 --> 08:29.300
Now the 80dPD server can access the content within that particular directory as

210
08:29.300 --> 08:29.720
we have

211
08:29.720 --> 08:32.160
specified and check this out as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
08:29.720 --> 08:32.160
specified and check this out as well.

212
08:32.160 --> 08:33.360
Let's close this for a moment.

213
08:33.360 --> 08:37.810
We can actually see in the logs, if I say pseudo SE alert and then check the

214
08:37.810 --> 08:38.400
logs in

215
08:38.400 --> 08:44.160
var log audit forward slash audit dot log, give this a moment to build.

216
08:44.160 --> 08:45.480
Look at what we actually have here.

217
08:45.480 --> 08:47.000
Let's scroll on up a little bit.

218
08:47.000 --> 08:52.510
It says here in the logs, SE Linux is preventing the actual 80dPD demon from

219
08:52.510 --> 08:53.560
getting access

220
08:53.560 --> 08:56.560
to the index file within the my site directory.

221
08:56.560 --> 09:00.470
So that of course the option isn't really just to effectively change SE Linux
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

221
08:56.560 --> 09:00.470
So that of course the option isn't really just to effectively change SE Linux

222
09:00.470 --> 09:00.920
and put

223
09:00.920 --> 09:04.060
it into permissive mode whereby it's going to allow a whole bunch of

224
09:04.060 --> 09:05.240
potentially dangerous

225
09:05.240 --> 09:06.480
interactions.

226
09:06.480 --> 09:10.450
What we really want to do is you want to effectively change the SE Linux

227
09:10.450 --> 09:11.840
context associated with

228
09:11.840 --> 09:12.840
the my site directory.

229
09:12.840 --> 09:16.160
So what I will do here is I'll just put SE Linux back on and I'll say pseudo

230
09:16.160 --> 09:17.440
set enforce

231
09:17.440 --> 09:19.160
and I'll put it back to enforcing.

232
09:19.160 --> 09:22.750
Let's go back to our webpage, type in IP address and now we're back to seeing

233
09:22.750 --> 09:23.600
this default

234
09:23.600 --> 09:24.600
webpage.

235
09:24.600 --> 09:28.440
We can't access the content within the my site directory anymore.

236
09:28.440 --> 09:30.880
So let's fix this by adding in the label.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

236
09:28.440 --> 09:30.880
So let's fix this by adding in the label.

237
09:30.880 --> 09:32.200
Now you can do this in different ways.

238
09:32.200 --> 09:35.790
You can use SE manage in order to have a permanent solution or if you just want

239
09:35.790 --> 09:36.280
to have

240
09:36.280 --> 09:40.610
a quick temporary change, you can just use CHcon and interest or simplicity

241
09:40.610 --> 09:41.280
right now

242
09:41.280 --> 09:44.730
and I would have used CHcon to change the label but when it comes to the actual

243
09:44.730 --> 09:45.360
playbook,

244
09:45.360 --> 09:46.520
we'll change it properly.

245
09:46.520 --> 09:50.200
So what I will do here is I'll specify that I want to attach the 80 DPD

246
09:50.200 --> 09:51.160
underscore sys

247
09:51.160 --> 09:55.350
underscore content underscore T label and I want to assign it to the forward

248
09:55.350 --> 09:56.120
slash my

249
09:56.120 --> 09:57.120
site directory.

250
09:57.120 --> 10:01.470
If I hit enter and I now go to that particular directory, so here's my root
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

250
09:57.120 --> 10:01.470
If I hit enter and I now go to that particular directory, so here's my root

251
10:01.470 --> 10:02.360
file system.

252
10:02.360 --> 10:06.320
If I say LS dash Z on the roots, look at what we actually have here.

253
10:06.320 --> 10:10.780
The my site directory now has the correct security context associated and

254
10:10.780 --> 10:12.400
inside of that directory.

255
10:12.400 --> 10:16.890
Here is the index dot HTML file and again, if I check the security context, we

256
10:16.890 --> 10:17.120
have

257
10:17.120 --> 10:18.840
recursively added that label.

258
10:18.840 --> 10:24.360
So this particular file here, the index dot HTML now has the correct label.

259
10:24.360 --> 10:28.840
So again, if you go back to our server and we just refresh the page, now we're

260
10:28.840 --> 10:29.400
getting

261
10:29.400 --> 10:34.250
access to the actual content within that directory, even with AC Linux fully
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

261
10:29.400 --> 10:34.250
access to the actual content within that directory, even with AC Linux fully

262
10:34.250 --> 10:35.120
enforced.

263
10:35.120 --> 10:37.320
So I know that was a lot to kind of wrap your head around.

264
10:37.320 --> 10:38.320
We had to create directories.

265
10:38.320 --> 10:40.480
We had to change configuration files.

266
10:40.480 --> 10:44.690
We had to modify labels now that we know what all the pieces are and why we do

267
10:44.690 --> 10:45.240
them.

268
10:45.240 --> 10:47.520
Let us now automate this process using Ansible.

269
10:47.520 --> 10:56.480
[BLANK_AUDIO]