WEBVTT

1
00:00.000 --> 00:03.880
So friends, in this particular video, what I want to highlight to you is how we

2
00:03.880 --> 00:04.480
can utilize

3
00:04.480 --> 00:09.040
Ansible to manage our SSH connections. So you may recall at the very beginning

4
00:09.040 --> 00:09.680
of this course,

5
00:09.680 --> 00:13.920
we set up passwordless authentication. And we did that by generating particular

6
00:13.920 --> 00:15.040
keys and copying

7
00:15.040 --> 00:19.590
those keys directly to our managed devices. Now, of course, you can do this any

8
00:19.590 --> 00:20.720
more manual way,

9
00:20.720 --> 00:25.300
just by going to each device one by one by one, and copying over the keys,

10
00:25.300 --> 00:26.080
allowing you to get

11
00:26.080 --> 00:30.470
that passwordless authentication. But as we know, we have this Ansible system.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.080 --> 00:30.470
that passwordless authentication. But as we know, we have this Ansible system.

12
00:30.470 --> 00:31.280
And if we can

13
00:31.280 --> 00:35.710
distribute these keys on mass at once, then this is obviously a much better

14
00:35.710 --> 00:37.120
solution. So let's look

15
00:37.120 --> 00:42.100
at how we can actually do such a thing. So right now, if I just say SSH Ansible

16
00:42.100 --> 00:43.120
, which is the user

17
00:43.120 --> 00:47.070
name, which is a username on both of my devices, and I target one of my devices

18
00:47.070 --> 00:47.920
such as yellow

19
00:47.920 --> 00:51.790
box, if I hit enter, notice I don't actually have to provide any password. I

20
00:51.790 --> 00:53.360
can just say who am I,

21
00:53.360 --> 00:58.720
we can do in C, I am on my other device, my managed device. So let's exit back

22
00:58.720 --> 00:59.680
out, we come back.

23
00:59.680 --> 01:04.020
And similarly, I could also log in to the blue box in the same way without a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.680 --> 01:04.020
And similarly, I could also log in to the blue box in the same way without a

24
01:04.020 --> 01:04.640
password,

25
01:04.640 --> 01:07.890
do an IP adder, we can see we are now on a different machine. And again, we

26
01:07.890 --> 01:08.960
exit back out to go back

27
01:08.960 --> 01:14.150
to our control node. However, if I happen to remove the configurations, let's

28
01:14.150 --> 01:15.200
go in here onto the

29
01:15.200 --> 01:19.470
yellow box, if I just say substitute user Ansible, and I type in the password

30
01:19.470 --> 01:20.960
of Ansible, if I cd to

31
01:20.960 --> 01:25.600
my home directory, and I do an LS dash LA, we see we have this hidden directory

32
01:25.600 --> 01:27.120
called dot SSH. And

33
01:27.120 --> 01:30.930
if I go inside, if you're doing LS, here we have this particular file here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:27.120 --> 01:30.930
if I go inside, if you're doing LS, here we have this particular file here

34
01:30.930 --> 01:32.320
authorized keys. And if

35
01:32.320 --> 01:36.260
I happen to cat this, this is where it stores all the information about those

36
01:36.260 --> 01:37.360
keys. And we can see

37
01:37.360 --> 01:41.970
here we have the actual key for Ansible at red box, that's if I want to log in

38
01:41.970 --> 01:43.120
from red box,

39
01:43.120 --> 01:46.910
I have my keys set up. Now, what if I do this, if I just remove this particular

40
01:46.910 --> 01:47.840
file, I will no

41
01:47.840 --> 01:52.060
longer be able to log in to the yellow box without having to provide a password

42
01:52.060 --> 01:53.040
. So again, let's go

43
01:53.040 --> 01:56.940
and test that. So we'll try to SSH into the yellow box. Look at this now, we

44
01:56.940 --> 01:58.160
actually have to provide

45
01:58.160 --> 02:02.410
a password. Now I can do that by typing the word Ansible, and now I get access.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:58.160 --> 02:02.410
a password. Now I can do that by typing the word Ansible, and now I get access.

46
02:02.410 --> 02:02.800
There's similar

47
02:02.800 --> 02:06.980
left I go to my blue box substitute user become Ansible, typing the Ansible

48
02:06.980 --> 02:08.400
password cd to the

49
02:08.400 --> 02:12.420
Ansible home directory, going to the hidden directory of SSH, doing LS, there's

50
02:12.420 --> 02:13.760
our authorized keys and

51
02:13.760 --> 02:18.720
let's remove them once again, we go back to the control nodes. If I try to SSH

52
02:18.720 --> 02:19.680
into the blue box,

53
02:19.680 --> 02:23.170
I now have to type the password, you see that. So that means if I try to run an

54
02:23.170 --> 02:24.080
Ansible playbook

55
02:24.080 --> 02:27.930
right now, such as let's maybe say play one, and I type in play one and to

56
02:27.930 --> 02:29.120
enter, as we can see

57
02:29.120 --> 02:33.430
here, we get permission denied, I'd actually have to say dash key to prompt me
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.120 --> 02:33.430
here, we get permission denied, I'd actually have to say dash key to prompt me

58
02:33.430 --> 02:34.240
for a password,

59
02:34.240 --> 02:38.750
and then provide the password on every playbook run. And now we can log in as

60
02:38.750 --> 02:39.680
we can see here.

61
02:39.680 --> 02:44.040
Now we want to set up the same configuration that we had before. This time

62
02:44.040 --> 02:44.960
though, we want to

63
02:44.960 --> 02:48.980
imagine we're on a very large network, and we don't want to have to do manually

64
02:48.980 --> 02:50.000
. This time we want

65
02:50.000 --> 02:54.700
to set things up using Ansible itself. So let's talk about how to do that. So

66
02:54.700 --> 02:55.600
if I Google for

67
02:55.600 --> 02:59.830
Ansible authorized key module, if I click this right here, this is not a built

68
02:59.830 --> 03:00.560
in module, it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:59.830 --> 03:00.560
in module, it's

69
03:00.560 --> 03:04.980
not part of Ansible core. As we can see here, it says this module is part of

70
03:04.980 --> 03:05.840
the Ansible

71
03:05.840 --> 03:09.680
POSIX collection. This is why we installed that collection at the beginning of

72
03:09.680 --> 03:10.400
this particular

73
03:10.400 --> 03:14.200
scale. So the way we use it in the playbook is going to be Ansible dot POSIX

74
03:14.200 --> 03:15.600
dot authorized key.

75
03:15.600 --> 03:19.830
And if we scroll on down, we can see some parameters. So an important one to

76
03:19.830 --> 03:21.280
specify if we scroll on

77
03:21.280 --> 03:26.570
down, is this require parameter, which is the key parameter. This is the public

78
03:26.570 --> 03:27.600
key that we want

79
03:27.600 --> 03:33.010
to actually provide. Similarly, if I scroll on down a little bit further, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:27.600 --> 03:33.010
to actually provide. Similarly, if I scroll on down a little bit further, we

80
03:33.010 --> 03:34.160
also have another

81
03:34.160 --> 03:38.630
require parameter that is the user parameter. This is going to be the user name

82
03:38.630 --> 03:39.760
that is associated

83
03:39.760 --> 03:43.620
with that particular key. So let's check this out now. If I go back to my

84
03:43.620 --> 03:44.960
control node, and what I

85
03:44.960 --> 03:49.230
will do is I'll create a playbook called play five dot YML. So let's go inside

86
03:49.230 --> 03:50.240
of here. So we'll

87
03:50.240 --> 03:53.310
go into insert mode, have our three hyphens at the top. Let's give this

88
03:53.310 --> 03:54.720
playbook a name, just say play

89
03:54.720 --> 03:58.790
five setting up SSH. Here we're going to target, we're going to target the all

90
03:58.790 --> 03:59.680
groups, and we will

91
03:59.680 --> 04:03.390
just say gather facts is equal to the value false, don't need to do that. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:59.680 --> 04:03.390
just say gather facts is equal to the value false, don't need to do that. And

92
04:03.390 --> 04:04.400
now we will define

93
04:04.400 --> 04:09.590
our tasks. So this task here is going to be copying the public key to the

94
04:09.590 --> 04:11.120
targets. Now we're going to

95
04:11.120 --> 04:14.470
use the Ansible POSIX authorized key module. And we're going to have to supply

96
04:14.470 --> 04:15.200
two particular

97
04:15.200 --> 04:19.780
parameters. The first one is the user, which in this case here, we're going to

98
04:19.780 --> 04:20.720
use the Ansible

99
04:20.720 --> 04:24.190
user that is user we want to be able to log in with without providing a

100
04:24.190 --> 04:25.280
password. And now we're

101
04:25.280 --> 04:28.360
going to have to specify the key. Now what I'm going to do here is use

102
04:28.360 --> 04:29.520
something known as a

103
04:29.520 --> 04:32.940
plugin. This is the lookup plugin. It's going to allow me to look up a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:29.520 --> 04:32.940
plugin. This is the lookup plugin. It's going to allow me to look up a

104
04:32.940 --> 04:34.400
particular file. And the

105
04:34.400 --> 04:38.120
syntax is as follows, we're going to have our double curly braces right here.

106
04:38.120 --> 04:39.040
And inside of that,

107
04:39.040 --> 04:42.700
I'm going to specify I'm going to use the lookup plugin. And then within

108
04:42.700 --> 04:43.440
parentheses,

109
04:43.440 --> 04:47.150
I'm going to supply two different arguments. The first is an quotation marks

110
04:47.150 --> 04:47.840
that is single

111
04:47.840 --> 04:51.240
quotation marks, by the way. And I'm going to specify that I'm going to look up

112
04:51.240 --> 04:51.920
a file. And

113
04:51.920 --> 04:57.520
then I have a comma. Now I supply my second arguments. So now I have to supply

114
04:57.520 --> 04:58.640
the path of the

115
04:58.640 --> 05:01.900
particular file that I want to copy over. Now if I just write and quit from now
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:58.640 --> 05:01.900
particular file that I want to copy over. Now if I just write and quit from now

116
05:01.900 --> 05:03.440
, so if I do a PWD,

117
05:03.440 --> 05:07.500
we can see that in the Ansible home directory, if I do an LS dash a to show my

118
05:07.500 --> 05:08.960
hidden directories,

119
05:08.960 --> 05:13.320
we can indeed see we have this hidden dot SSH directory. And if we go inside of

120
05:13.320 --> 05:13.680
here,

121
05:13.680 --> 05:18.560
doing LS is here is the key that I want to copy over the ID RSA PUBKEY.

122
05:18.560 --> 05:20.080
Remember the public one,

123
05:20.080 --> 05:24.180
we do not copy over the private one. So inside of this particular file, this is

124
05:24.180 --> 05:24.720
the key I want

125
05:24.720 --> 05:29.980
to copy. So check this out. Let's go back into play number five and answer. I

126
05:29.980 --> 05:30.560
specify the one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
05:29.980 --> 05:30.560
specify the one

127
05:30.560 --> 05:34.470
to lookup a file. And all I need to do now is to provide the path to that

128
05:34.470 --> 05:36.000
particular file. So I'll

129
05:36.000 --> 05:43.270
say home, Ansible dot SSH. And then it's going to be ID underscore RSA dot pub

130
05:43.270 --> 05:44.880
kill. So let's just

131
05:44.880 --> 05:48.960
copy this over. And again, just before I run this as a quick test, let's try to

132
05:48.960 --> 05:50.480
SSH into Ansible

133
05:50.480 --> 05:54.200
as a user into the yellow box. Again, we're still prompt of the password.

134
05:54.200 --> 05:55.280
However, when I now run

135
05:55.280 --> 05:59.190
this playbook, so I'll say Ansible playbook, playbook five dot YML and I'll say

136
05:59.190 --> 06:00.240
dash K to prompt me
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:59.190 --> 06:00.240
dash K to prompt me

137
06:00.240 --> 06:04.230
for the password to initially log in, I'll supply that password of Ansible and

138
06:04.230 --> 06:05.280
to answer, give it a

139
06:05.280 --> 06:09.130
moment. And now we can see here, we have copied over the public key to the

140
06:09.130 --> 06:11.200
targets. Now, if I just

141
06:11.200 --> 06:16.450
arrow up and I tried to SSH into Ansible and hit enter, straight away, we'll

142
06:16.450 --> 06:17.360
log in without

143
06:17.360 --> 06:21.040
the password. And again, if I exit back out, we've done the same thing with the

144
06:21.040 --> 06:21.440
blue box,

145
06:21.440 --> 06:25.820
because we have successfully copied over those public keys. So let's just hit

146
06:25.820 --> 06:26.720
enter. Once again,

147
06:26.720 --> 06:30.720
we're now in the blue box, you see that? And just to verify if I go back to my
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
06:26.720 --> 06:30.720
we're now in the blue box, you see that? And just to verify if I go back to my

148
06:30.720 --> 06:31.920
divisor right here,

149
06:31.920 --> 06:36.210
and then my home directory, I go into my hidden directory of SSH to an LS, we

150
06:36.210 --> 06:36.960
can now see here,

151
06:36.960 --> 06:40.500
we have once again got the authorized keys that we previously deleted. And

152
06:40.500 --> 06:41.120
again, I can just

153
06:41.120 --> 06:43.480
cat that's open, there we are right there.