WEBVTT

1
00:00.000 --> 00:04.000
Okay friends, so let's see how we can actually build out this inventory file.

2
00:04.000 --> 00:08.500
So within my actual directory right here, all I'm going to do is I'm going to

3
00:08.500 --> 00:09.000
save

4
00:09.000 --> 00:12.000
then and I'll call this inventory dot ionized.

5
00:12.000 --> 00:14.000
I'm going to be using the I and I format.

6
00:14.000 --> 00:17.590
So the very first thing I'm going to have to do is to create two different

7
00:17.590 --> 00:18.000
groups.

8
00:18.000 --> 00:21.160
One is going to be called the test group and the other one is going to be

9
00:21.160 --> 00:22.000
called the production group.

10
00:22.000 --> 00:26.000
Now the way we denote a group is utilizing these square brackets.

11
00:26.000 --> 00:29.000
Now within each group, we also have the constituent host.

12
00:29.000 --> 00:32.000
The first one is going to be device number one and for the production group,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.000 --> 00:32.000
The first one is going to be device number one and for the production group,

13
00:32.000 --> 00:34.000
we're going to add in device number two.

14
00:34.000 --> 00:39.010
Now also, we want to place both of these groups and all of their constituent

15
00:39.010 --> 00:40.000
members inside

16
00:40.000 --> 00:42.000
of a parent group called rel servers.

17
00:42.000 --> 00:46.000
Now the way we do this is again have our square brackets and we'll just say rel

18
00:46.000 --> 00:47.000
underscore servers.

19
00:47.000 --> 00:50.490
Now here's the thing, you can't just close your square brackets and then

20
00:50.490 --> 00:51.000
specify that the

21
00:51.000 --> 00:54.000
groups that belong to this parent group is going to be test and production.

22
00:54.000 --> 00:58.000
That is almost correct, but we're missing a very key detail.

23
00:58.000 --> 01:02.860
We want to specify that these actually are child groups and the way we do this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:58.000 --> 01:02.860
We want to specify that these actually are child groups and the way we do this

24
01:02.860 --> 01:03.000
is by

25
01:03.000 --> 01:05.000
specifying the colon and then children.

26
01:05.000 --> 01:09.410
This tells us that the test group and production groups both belong inside of

27
01:09.410 --> 01:10.000
the rel servers group.

28
01:10.000 --> 01:13.000
So if you have to get that correct, give yourself a pat in the back, that is

29
01:13.000 --> 01:13.000
the right way to

30
01:13.000 --> 01:17.000
solve this particular problem right now, if writing quit to save the changes.

31
01:17.000 --> 01:20.000
Now we can see here we have this inventory file.

32
01:20.000 --> 01:26.000
Now what we want to do here is also create an Ansible.cfg file.

33
01:26.000 --> 01:28.000
So here's the thing within our inventory.

34
01:28.000 --> 01:32.000
We want to provide a path that is going to point to that inventory.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:28.000 --> 01:32.000
We want to provide a path that is going to point to that inventory.

35
01:32.000 --> 01:34.000
I and I fail that we just specified.

36
01:34.000 --> 01:37.000
We also want to configure privilege escalation.

37
01:37.000 --> 01:39.000
How do we actually get to root privileges?

38
01:39.000 --> 01:42.000
So we're going to specify that we want to be able to use the sudo command.

39
01:42.000 --> 01:46.000
We also want to specify that the super user account is going to be known as

40
01:46.000 --> 01:46.000
root.

41
01:46.000 --> 01:51.600
And we also want to specify that we don't have to require a password when elev

42
01:51.600 --> 01:52.000
ating

43
01:52.000 --> 01:53.000
through our privileges.

44
01:53.000 --> 01:55.000
Now that's not the only thing we want to do.

45
01:55.000 --> 01:59.000
We also want to specify a path for where our collections are going to reside.

46
01:59.000 --> 02:04.000
In a similar fashion, we also want to specify a path specifying where our rows
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.000 --> 02:04.000
In a similar fashion, we also want to specify a path specifying where our rows

47
02:04.000 --> 02:05.000
actually reside.

48
02:05.000 --> 02:11.390
Now we want to have a default directory for our collections inside of the user

49
02:11.390 --> 02:12.000
Ansible

50
02:12.000 --> 02:13.000
Home Directory.

51
02:13.000 --> 02:16.000
And the same thing is true of the rows directory that would be the default.

52
02:16.000 --> 02:17.000
Now what does this actually mean?

53
02:17.000 --> 02:20.000
Well, the user will be happy to be here as Ansible.

54
02:20.000 --> 02:25.000
And if we cd to that Home Directory, if I did PWD, this is the Home Directory

55
02:25.000 --> 02:25.000
right here.

56
02:25.000 --> 02:29.000
So inside of here, we should also have another directory called collections.

57
02:29.000 --> 02:31.000
That should be our default collections path.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.000 --> 02:31.000
That should be our default collections path.

58
02:31.000 --> 02:34.500
And also similarly, we should also have a rows directory within this directory

59
02:34.500 --> 02:35.000
structure.

60
02:35.000 --> 02:38.000
And that should also be our default path for our rows.

61
02:38.000 --> 02:43.490
And lastly, in our case, we want to specify that the Ansible user is going to

62
02:43.490 --> 02:44.000
be the user

63
02:44.000 --> 02:47.000
that is logging in to both of the managed nodes.

64
02:47.000 --> 02:51.200
So pause the video, try to write up this configuration file and see how close

65
02:51.200 --> 02:52.000
you get.

66
02:52.000 --> 02:55.000
For now, I will just go and show you what my solution was going to be.

67
02:55.000 --> 02:57.000
I will save them Ansible.cfg.

68
02:57.000 --> 03:01.870
I'm going to insert mode and then I will specify my square brackets and pass in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:57.000 --> 03:01.870
I'm going to insert mode and then I will specify my square brackets and pass in

69
03:01.870 --> 03:02.000
my default

70
03:02.000 --> 03:03.000
directive.

71
03:03.000 --> 03:06.000
So the remote user, we're going to log in as will be Ansible.

72
03:06.000 --> 03:10.690
I'm going to specify that my inventory here is going to be in my Home Directory

73
03:10.690 --> 03:11.000
.

74
03:11.000 --> 03:15.000
So I could either specify that as Home Ansible and then specify the actual file

75
03:15.000 --> 03:15.000
, which is

76
03:15.000 --> 03:19.000
inventory and I gave it an INI extension, although you don't actually have to,

77
03:19.000 --> 03:19.000
or alternatively,

78
03:19.000 --> 03:23.700
what I could do is I could say the tilde sign forward slash, which is affected

79
03:23.700 --> 03:24.000
by Home Directory

80
03:24.000 --> 03:28.290
to or alternatively, I could just provide the relative path and just say

81
03:28.290 --> 03:30.000
inventory.ini.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:30.000 --> 03:32.000
Each of the solutions all are fine.

83
03:32.000 --> 03:34.000
So I'll just leave it in the simplest way.

84
03:34.000 --> 03:38.000
Now what I want to do is I want to specify the as pass as equal to false.

85
03:38.000 --> 03:41.000
We don't have to ask for a password to use our particular account.

86
03:41.000 --> 03:45.350
And also what I want to do to specify my privilege escalation directives also

87
03:45.350 --> 03:47.000
privilege underscore

88
03:47.000 --> 03:49.000
escalation within my square brackets.

89
03:49.000 --> 03:52.000
And what I want to do here is I'll say become is equal to true.

90
03:52.000 --> 03:56.000
This is how we elevate to super user and I will say they become method.

91
03:56.000 --> 03:58.000
How do we actually get our super user privileges?

92
03:58.000 --> 04:02.000
We use the command sudo and I'll say the become user, which is going to be the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:58.000 --> 04:02.000
We use the command sudo and I'll say the become user, which is going to be the

93
04:02.000 --> 04:03.000
super user.

94
04:03.000 --> 04:05.000
That is going to be the root accounts.

95
04:05.000 --> 04:07.000
And similarly, I don't want to have to use passwords.

96
04:07.000 --> 04:11.200
So I'll say when I become the root user, I want to specify that the become as

97
04:11.200 --> 04:12.000
password

98
04:12.000 --> 04:14.000
is equal to false.

99
04:14.000 --> 04:18.000
Now we also want to specify what our rows path and our collections path is.

100
04:18.000 --> 04:21.490
Now let me just show you a little tip that we can use to make this a little bit

101
04:21.490 --> 04:22.000
easier.

102
04:22.000 --> 04:25.000
If you have it going to Vim, it's the answerable and then answerable.cfg.

103
04:25.000 --> 04:28.000
We actually get a little sample configuration file now.

104
04:28.000 --> 04:31.150
It actually doesn't really help us out too much in that it doesn't show the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
04:28.000 --> 04:31.150
It actually doesn't really help us out too much in that it doesn't show the

105
04:31.150 --> 04:32.000
actual parameters

106
04:32.000 --> 04:36.140
of what we want to use. But what we can see here is we can actually generate a

107
04:36.140 --> 04:37.000
little file

108
04:37.000 --> 04:39.000
by copying this particular command.

109
04:39.000 --> 04:41.000
Now what I'm going to do here is I'm going to copy this.

110
04:41.000 --> 04:44.000
Now like I say, I've already created this answerable.cfg.

111
04:44.000 --> 04:47.000
So I actually don't want to create another one and overwrite the existing one

112
04:47.000 --> 04:49.000
with the configurations I had.

113
04:49.000 --> 04:52.000
So all those are just changed in name here to be answerable template.

114
04:52.000 --> 04:55.620
So what it's going to do is going to generate this new file here, which we can

115
04:55.620 --> 04:57.000
see if I go into the answerable template.

116
04:57.000 --> 05:01.000
Inside of here, we actually get all of the information that we can specify
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:57.000 --> 05:01.000
Inside of here, we actually get all of the information that we can specify

117
05:01.000 --> 05:01.000
within

118
05:01.000 --> 05:03.000
that these answerable configuration files.

119
05:03.000 --> 05:06.000
Now we want to be able to specify a path for a collection.

120
05:06.000 --> 05:09.000
So if I just search for collections, we can actually see collections path.

121
05:09.000 --> 05:13.000
All I'm going to do is I'm going to copy this particular path that we see here.

122
05:13.000 --> 05:15.000
Okay, so let me grab this.

123
05:15.000 --> 05:18.000
And if I go into answerable.cfg, let me go back into my defaults here.

124
05:18.000 --> 05:20.000
And I'm just going to say collections path.

125
05:20.000 --> 05:24.000
And then what I'm going to do is say equals and then paste in that part I just

126
05:24.000 --> 05:24.000
copied.

127
05:24.000 --> 05:28.000
Now what we're actually seen here are comma separated values.

128
05:28.000 --> 05:32.000
These are pretty much all the locations whereby answerable is going to search
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
05:28.000 --> 05:32.000
These are pretty much all the locations whereby answerable is going to search

129
05:32.000 --> 05:33.000
to find your collections.

130
05:33.000 --> 05:36.490
The one at the beginning is going to be our first one, which in this case here,

131
05:36.490 --> 05:39.000
it specifies forward slash collections.

132
05:39.000 --> 05:42.890
Okay, now this actually is in the root directory here because it starts with

133
05:42.890 --> 05:44.000
the forward slash.

134
05:44.000 --> 05:47.000
We want to have our collections within our home directory.

135
05:47.000 --> 05:51.110
So what you could do is just like before I can go in and I can add in a tilde

136
05:51.110 --> 05:53.000
or if I so wish I could just use the relative path

137
05:53.000 --> 05:56.570
and remove the forward slash and then we specify that the first place we'll

138
05:56.570 --> 05:59.000
check will be in the home directory.

139
05:59.000 --> 06:01.960
I either direct it in which this file resides and then we look for a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:59.000 --> 06:01.960
I either direct it in which this file resides and then we look for a

140
06:01.960 --> 06:03.000
collections folder.

141
06:03.000 --> 06:06.960
Then we also search another path which in this case here is going to be user

142
06:06.960 --> 06:08.000
share answerable collections.

143
06:08.000 --> 06:10.000
Okay, so we include both of these.

144
06:10.000 --> 06:13.000
Now let's go back in to the template once again.

145
06:13.000 --> 06:17.410
If I also search for rows path, we can see we have this particular path which

146
06:17.410 --> 06:19.000
also has an additional component

147
06:19.000 --> 06:22.900
or rather an additional directory should I say so let's copy this back into the

148
06:22.900 --> 06:24.000
answerable CFG

149
06:24.000 --> 06:28.710
and all I will do here is I will say it rolls path is equal to and all I will

150
06:28.710 --> 06:30.000
do is I'll paste this in right here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
06:30.000 --> 06:32.000
and again, these are comma separate values.

152
06:32.000 --> 06:35.050
So the first one we're going to look in is going to be forward slash rolls,

153
06:35.050 --> 06:36.000
which is going to be at the root directory.

154
06:36.000 --> 06:37.000
So we don't want that.

155
06:37.000 --> 06:39.000
So let's just keep this relative path.

156
06:39.000 --> 06:42.000
And then the second location will be user share answerable rolls.

157
06:42.000 --> 06:45.680
And then if we can't find the role in that particular directory, we're going to

158
06:45.680 --> 06:47.000
search in the Etsy directory

159
06:47.000 --> 06:49.000
for Etsy answerable roles.

160
06:49.000 --> 06:52.050
Okay. And in fact, what I've just noticed is that I'm going to have to remove

161
06:52.050 --> 06:53.000
these little quotation marks right here.

162
06:53.000 --> 06:54.000
So let me just remove this right here.

163
06:54.000 --> 06:55.000
So that is correct.

164
06:55.000 --> 06:57.000
And the same is true for my role right here.

165
06:57.000 --> 07:00.000
Let's just do the same remove view and remove view.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
07:00.000 --> 07:01.000
That is much, much better.

167
07:01.000 --> 07:03.000
So let's just save this.

168
07:03.000 --> 07:06.730
And what I've now done, what I want to do is I want to create an answerable

169
07:06.730 --> 07:09.000
user account on all my managed nodes.

170
07:09.000 --> 07:12.250
So right now, in both of my managed nodes, I actually have an account called n

171
07:12.250 --> 07:13.000
ugget user.

172
07:13.000 --> 07:16.000
Whatever account you have, you can also substitute that value in.

173
07:16.000 --> 07:19.220
So what I'm going to do here is because I have my basic answerable

174
07:19.220 --> 07:20.000
configuration, i.e.

175
07:20.000 --> 07:23.720
I have my inventory file, which we can see right here, as well as my answerable

176
07:23.720 --> 07:25.000
cfg.

177
07:25.000 --> 07:28.000
In fact, what I can do here is just remove this little template file.

178
07:28.000 --> 07:29.000
We don't need that anymore.

179
07:29.000 --> 07:30.000
So all we have are these two.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
07:30.000 --> 07:34.340
What I can now do is run my answerable ad hoc commands against both of my

181
07:34.340 --> 07:39.000
devices, which is going to allow me to quickly set up these particular values.

182
07:39.000 --> 07:42.000
And again, this is not something we're going to have to do in the examination.

183
07:42.000 --> 07:44.610
It's just something we're going to have to run through to get our own lab

184
07:44.610 --> 07:46.000
environment set up in this case.

185
07:46.000 --> 07:49.400
So the very first thing I'm going to do here is I'm going to say SSH with the

186
07:49.400 --> 07:51.000
user name of nugget user.

187
07:51.000 --> 07:54.000
And then I'll target device number one.

188
07:54.000 --> 07:56.780
Now we can see here, I'm going to have to add the fingerprint if I just say yes

189
07:56.780 --> 07:57.000
.

190
07:57.000 --> 07:59.000
Right now, I don't even have to log in.

191
07:59.000 --> 08:02.000
I would just press ctrl C as long as I've added the fingerprint.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

191
07:59.000 --> 08:02.000
I would just press ctrl C as long as I've added the fingerprint.

192
08:02.000 --> 08:03.000
That's good.

193
08:03.000 --> 08:07.230
And if I say device two, and to enter, again, yes, to add the fingerprint in c

194
08:07.230 --> 08:09.000
trl C to terminate the connection.

195
08:09.000 --> 08:11.000
Now what I want to do is I want to use answerable here.

196
08:11.000 --> 08:15.150
So I'll say answerable all then dash you and the user I want to log into or

197
08:15.150 --> 08:17.000
rather in with is nugget user.

198
08:17.000 --> 08:22.360
Then I'll say dash k to ask on my password dash B to become the root user dash

199
08:22.360 --> 08:26.110
capital K to ask for the root user password and then dash N to specify the

200
08:26.110 --> 08:29.560
module, which in this case here will be the user module or then say dash a to

201
08:29.560 --> 08:33.000
specify my argument, which is simply which account I want to create.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
08:29.560 --> 08:33.000
specify my argument, which is simply which account I want to create.

202
08:33.000 --> 08:39.440
So I'll say name is equal to answerable. And if I answer and just type in the

203
08:39.440 --> 08:41.000
password or password one and again password one.

204
08:41.000 --> 08:44.000
Now we can see here we have actually created this answerable user account on

205
08:44.000 --> 08:45.000
both of my devices.

206
08:45.000 --> 08:49.870
Now what I want to do is I want to give my answerable user a password of simply

207
08:49.870 --> 08:51.000
answerable.

208
08:51.000 --> 08:52.000
So let me clear the screen.

209
08:52.000 --> 08:55.610
If I add a what I'm going to do a similar thing, but this time I'm not going to

210
08:55.610 --> 08:57.000
use the user module.

211
08:57.000 --> 09:01.560
The module I will use will be the shell module and all I will do here is say
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
08:57.000 --> 09:01.560
The module I will use will be the shell module and all I will do here is say

212
09:01.560 --> 09:05.900
dash a and then echo in the password of answerable and then pipe it into past w

213
09:05.900 --> 09:11.130
d and then also dash dash SD D and then answerable, which is going to be the

214
09:11.130 --> 09:12.000
account for targeting.

215
09:12.000 --> 09:16.160
So if I had entered again type in my passwords and to enter now we can see here

216
09:16.160 --> 09:19.000
we've updated the password for answerable.

217
09:19.000 --> 09:22.810
Now what I want to do is I want to ensure that these answerable accounts have

218
09:22.810 --> 09:26.750
super user passwords or rather super user access and we don't have to supply a

219
09:26.750 --> 09:30.000
password when we happen to invoke that super user access.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

220
09:30.000 --> 09:33.430
So again, I will just add a what and the module I'm going to use this

221
09:33.430 --> 09:36.980
particular time is going to be the copy module and I want to copy over this

222
09:36.980 --> 09:38.000
particular contents.

223
09:38.000 --> 09:42.000
So I will say dash a and then with the quotation marks, I will say content is

224
09:42.000 --> 09:46.220
equal to and then within single quotation marks, I will say answerable all in

225
09:46.220 --> 09:51.000
capital letters is equal to within parentheses all and then a space and I'll

226
09:51.000 --> 09:56.000
just say no past wd colon all and then have my single quotation mark

227
09:56.000 --> 09:56.670
So I will specify that the destination is going to be copy to forward slash it

228
09:56.670 --> 10:05.650
say soudores dot D forward slash answerable. Basically, all we're doing is what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
09:56.670 --> 10:05.650
say soudores dot D forward slash answerable. Basically, all we're doing is what

229
10:05.650 --> 10:07.000
we did with the control node.

230
10:07.000 --> 10:11.390
We are copying over this particular content and we're targeting the it say it's

231
10:11.390 --> 10:15.400
to do or answerable file. Okay. So if I hit enter here and again type in my

232
10:15.400 --> 10:19.000
passwords and to enter now that information is copied over.

233
10:19.000 --> 10:23.270
So what I should be able to do now is I should be able to say ssh answerable at

234
10:23.270 --> 10:27.720
device number one and then type in the password of answerable and I should be

235
10:27.720 --> 10:32.250
able to say so that's right on the account and we should be able to list or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

235
10:27.720 --> 10:32.250
able to say so that's right on the account and we should be able to list or

236
10:32.250 --> 10:33.000
rather the

237
10:33.000 --> 10:42.320
the content of the right to which we can without having to enter on a password.

238
10:42.320 --> 10:42.660
Similarly on device number two, typing the password of answerable. Now again,

239
10:42.660 --> 10:45.110
if I just happened to say LS on the route itself, we're going to say

240
10:45.110 --> 10:48.830
progression denied, but we can say pseudo LS on the route without a password

241
10:48.830 --> 10:49.000
and we do get the content.

242
10:49.000 --> 10:52.110
So this is looking good. What we now want to do though is to set up password

243
10:52.110 --> 10:57.610
less logging in. So on the control node, I will say ssh hyphen Q gen. Okay, and

244
10:57.610 --> 10:59.000
I'll just hit enter, enter and enter.

245
10:59.000 --> 11:03.890
And all I want to do is I want to say ssh hyphen copy ID and target device
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

245
10:59.000 --> 11:03.890
And all I want to do is I want to say ssh hyphen copy ID and target device

246
11:03.890 --> 11:07.450
number one. So all I will do is type in the password of answerable and to

247
11:07.450 --> 11:08.000
answer.

248
11:08.000 --> 11:11.100
We now copy over the key. Let's arrow up to the same thing for device number

249
11:11.100 --> 11:14.000
two again, type in the password of answerable and to answer.

250
11:14.000 --> 11:19.000
Now we've added yet another key. So if I just simply say ssh at device one,

251
11:19.000 --> 11:24.000
enter the automatic log in straight away without any password authentication.

252
11:24.000 --> 11:28.210
Similarly on device two, we log in straight away. Okay, so let's exit back out

253
11:28.210 --> 11:30.000
with that. Now done.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

254
11:30.000 --> 11:33.980
I can just say answerable all dash M and I'll just say paying to try to ping

255
11:33.980 --> 11:36.000
all of my devices with the all module and to enter.

256
11:36.000 --> 11:39.440
Then we can see here successful target or devices and similarly if I just

257
11:39.440 --> 11:44.000
happened to say answerable all and then say dash A for the argument and then

258
11:44.000 --> 11:47.000
say LS dash L against the route account and to enter.

259
11:47.000 --> 11:50.540
Now we can see the actual see the contents of the route directly for both

260
11:50.540 --> 11:51.000
devices.