WEBVTT 1 00:00.000 --> 00:02.920 So friends, let's walk through the validation challenge. 2 00:02.920 --> 00:07.320 The very first thing I have to do is to create a new directory on one of my 3 00:07.320 --> 00:08.200 managed devices 4 00:08.200 --> 00:10.720 called forward slash validation hyphen der. 5 00:10.720 --> 00:17.000 So on my blue box, I will say sudo mk der forward slash validation hyphen der. 6 00:17.000 --> 00:21.840 Now it has created what I now have to do is to check the SEO Linux security 7 00:21.840 --> 00:23.000 context information 8 00:23.000 --> 00:24.000 of this directory. 9 00:24.000 --> 00:27.800 So I'll say LS dash Z on the root directory. 10 00:27.800 --> 00:32.920 And now we see the validation der actually has the tag default underscore T. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:27.800 --> 00:32.920 And now we see the validation der actually has the tag default underscore T. So 11 00:32.920 --> 00:33.200 now back 12 00:33.200 --> 00:35.600 in my control node, I'm going to have to create a playbook. 13 00:35.600 --> 00:39.120 So let's call this validation dot ymail going to insert mode have our three hyp 14 00:39.120 --> 00:39.680 hens at the 15 00:39.680 --> 00:42.880 top, give the playbook a name and we'll just call this validation one. 16 00:42.880 --> 00:45.960 Now the host I'm going to target in my case here is just going to be the blue 17 00:45.960 --> 00:46.560 box or set 18 00:46.560 --> 00:48.960 gather facts to be false. 19 00:48.960 --> 00:52.120 And what I'm going to have to do is to write a playbook that uses the rail 20 00:52.120 --> 00:52.800 system roles 21 00:52.800 --> 00:56.780 as the Linux role to ensure that the managed device has a Linux to be 22 00:56.780 --> 00:57.960 configured in the 23 00:57.960 --> 00:59.120 enforcing modes. 24 00:59.120 --> 01:00.760 So let me define my vows right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 00:59.120 --> 01:00.760 So let me define my vows right here. 25 01:00.760 --> 01:06.360 And I'm going to say se Linux underscore states as to the value enforcing. 26 01:06.360 --> 01:09.620 So the next thing that I'm going to have to do is to use the same playbook and 27 01:09.620 --> 01:10.000 use the 28 01:10.000 --> 01:14.480 role to change the security context type of the validation that directory to be 29 01:14.480 --> 01:14.840 user 30 01:14.840 --> 01:15.840 home to you. 31 01:15.840 --> 01:19.740 So in this case here, I'm going to say se Linux if contexts, and then I'm going 32 01:19.740 --> 01:20.280 to specify 33 01:20.280 --> 01:24.880 that my target is going to be forward slash validation hyphen der and then I'll 34 01:24.880 --> 01:25.240 have 35 01:25.240 --> 01:29.880 my open parentheses and say forward slash dot asterix. 36 01:29.880 --> 01:33.450 And then I'll have my question mark and then also the se type which is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:29.880 --> 01:33.450 And then I'll have my question mark and then also the se type which is going to 37 01:33.450 --> 01:34.760 be my label. 38 01:34.760 --> 01:38.530 And this case here, it's going to be user underscore home underscore T and then 39 01:38.530 --> 01:38.880 I'll 40 01:38.880 --> 01:41.640 specify that the file type is going to be a directory. 41 01:41.640 --> 01:43.440 And then I'll close my color braces. 42 01:43.440 --> 01:46.920 Now this will be making the modification via se manage. 43 01:46.920 --> 01:50.080 So what I want to do is I want to use my restore con command, so I'll say se 44 01:50.080 --> 01:50.840 Linux restore 45 01:50.840 --> 01:54.040 does and now I specify the directory I want to be restoring. 46 01:54.040 --> 01:58.620 So it's going to be forward slash validation hyphen der and now it'll specify 47 01:58.620 --> 01:59.120 my role 48 01:59.120 --> 02:04.300 that I want to use which is going to be a rail system hyphen roles dot se Linux WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 48 01:59.120 --> 02:04.300 that I want to use which is going to be a rail system hyphen roles dot se Linux 49 02:04.300 --> 02:04.400 . 50 02:04.400 --> 02:08.200 So let's save this playbook and let's give it a run and to enter. 51 02:08.200 --> 02:11.470 So the playbook completes if we go to our device right now, let's check the new 52 02:11.470 --> 02:11.960 security 53 02:11.960 --> 02:17.080 context and as we can see the validation directory has updated its label. 54 02:17.080 --> 02:19.860 So now the next thing we're going to have to do is to write a second playbook 55 02:19.860 --> 02:20.120 that is 56 02:20.120 --> 02:26.420 going to configure firewall D to permit SSH HTTP HTTPS and NP and squared 57 02:26.420 --> 02:27.680 services. 58 02:27.680 --> 02:31.400 So what I will do is create a new playbook called validation to dot Y mail. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 02:27.680 --> 02:31.400 So what I will do is create a new playbook called validation to dot Y mail. 59 02:31.400 --> 02:33.800 Let's just target the same host again in my case here. 60 02:33.800 --> 02:38.130 It's going to be blue box gather facts as false and now let's define my vars 61 02:38.130 --> 02:38.680 and now 62 02:38.680 --> 02:47.240 specify the rules so I want to allow SSH HTTP HTTPS and NP as well as squid. 63 02:47.240 --> 02:48.520 So let's define our tasks. 64 02:48.520 --> 02:51.880 Let's get this task in name or just the updating firewall config. 65 02:51.880 --> 02:56.200 Let's use the answerable POSIX firewall D module specify the service we want to 66 02:56.200 --> 02:56.760 configure 67 02:56.760 --> 02:59.400 is going to be the item that we happen to be looking through. 68 02:59.400 --> 03:03.230 So we'll have our double curly braces and the keyword item and we'll specify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 02:59.400 --> 03:03.230 So we'll have our double curly braces and the keyword item and we'll specify 69 03:03.230 --> 03:03.400 that the 70 03:03.400 --> 03:07.320 state is going to be enabled and then we want to specify what it is we're going 71 03:07.320 --> 03:07.440 to 72 03:07.440 --> 03:08.440 look through. 73 03:08.440 --> 03:12.080 So we'll have our double curly braces once again and we're going to look to the 74 03:12.080 --> 03:12.520 variable 75 03:12.520 --> 03:14.080 rules that we've just defined. 76 03:14.080 --> 03:17.400 So let's save this and let's try running the second playbook. 77 03:17.400 --> 03:18.920 So now we make a modification. 78 03:18.920 --> 03:24.210 If I go to my blue box and I say pseudo firewall dash CMD dash dash list 79 03:24.210 --> 03:26.000 services and to enter 80 03:26.000 --> 03:30.150 type in my password and as we can see amongst the services that we have allowed WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 80 03:26.000 --> 03:30.150 type in my password and as we can see amongst the services that we have allowed 81 03:30.150 --> 03:30.520 we have 82 03:30.520 --> 03:36.120 our HTTP HTTPS SNMP squared and SSH services. 83 03:36.120 --> 03:38.640 So that is us for our validation challenge. 84 03:38.640 --> 03:40.200 I hope it's been informative for you. 85 03:40.200 --> 03:41.720 I'd like to thank you for viewing.