WEBVTT

1
00:00.000 --> 00:03.840
Now, throughout this skill, we have been learning different modules such as how

2
00:03.840 --> 00:05.600
to use the user module.

3
00:05.600 --> 00:09.620
Now recall, when we learned how to use this particular module earlier on within

4
00:09.620 --> 00:10.640
this skill,

5
00:10.640 --> 00:13.880
we did not actually set a password for our user.

6
00:13.880 --> 00:18.220
Remember, we created the particular user and then via the command line manually

7
00:18.220 --> 00:18.320
,

8
00:18.320 --> 00:22.280
we went in and assigned a password for that user so they could effectively log

9
00:22.280 --> 00:22.560
in.

10
00:22.560 --> 00:26.320
What I now want to do in this particular video is to walk through how we can

11
00:26.320 --> 00:28.480
actually handle this particular problem

12
00:28.480 --> 00:30.720
when using the user module.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.480 --> 00:30.720
when using the user module.

13
00:30.720 --> 00:33.840
So with that said, let's dig in and check it out.

14
00:33.840 --> 00:37.680
Now, one thing to say about passwords is that they should be stored utilizing

15
00:37.680 --> 00:39.080
their password hash.

16
00:39.080 --> 00:44.000
Basically, this is a one-way function that is going to transform the clear text

17
00:44.000 --> 00:45.800
into a formal ciphertext.

18
00:45.800 --> 00:49.880
Pretty much when we type in our username and then supply the password,

19
00:49.880 --> 00:52.960
the password should go through a particular hashing algorithm,

20
00:52.960 --> 00:56.920
which is going to generate this particular hash and then the hash generated is

21
00:56.920 --> 00:57.800
going to be compared

22
00:57.800 --> 00:59.960
with the hash stored on the system.

23
00:59.960 --> 01:03.360
If they match up, then you must have supplied the correct password.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.960 --> 01:03.360
If they match up, then you must have supplied the correct password.

24
01:03.360 --> 01:07.900
So in this case here, what we want to do is we actually want to generate a

25
01:07.900 --> 01:08.840
password hash.

26
01:08.840 --> 01:12.860
Once we have done this, we can supply this password hash in with our Ansible

27
01:12.860 --> 01:13.440
playbook,

28
01:13.440 --> 01:17.160
which we can then use to create our passwords for our user.

29
01:17.160 --> 01:21.360
So notice if you happen to go into the X8 shadow file, for example,

30
01:21.360 --> 01:23.880
oh, and of course, this is going to require super user privileges.

31
01:23.880 --> 01:25.480
So I'll use my pseudo command.

32
01:25.480 --> 01:29.110
Take, for example, all of this data right here, what we're looking at is the

33
01:29.110 --> 01:30.120
password hash
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:29.110 --> 01:30.120
password hash

34
01:30.120 --> 01:34.750
for the Ansible user, which as we know, the actual password itself is just

35
01:34.750 --> 01:35.400
simply the word

36
01:35.400 --> 01:37.080
Ansible in lowercase.

37
01:37.080 --> 01:41.800
This is transformed and stored as this particular value here, this string.

38
01:41.800 --> 01:45.000
Now, there are a couple of ways we can handle this particular issue.

39
01:45.000 --> 01:48.860
Let's say I wanted to create a user called Matt and I wanted the user's

40
01:48.860 --> 01:50.400
password to be Matt one.

41
01:50.400 --> 01:52.120
Of course, this is a very bad password.

42
01:52.120 --> 01:56.200
It's not good security, but just in the interest of keeping things simple,

43
01:56.200 --> 01:58.280
let's just say that was a combination.

44
01:58.280 --> 02:02.520
So what we want to do is we want to generate a hash of this particular password
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:58.280 --> 02:02.520
So what we want to do is we want to generate a hash of this particular password

45
02:02.520 --> 02:02.520
.

46
02:02.520 --> 02:05.880
And then we will supply this value in to our Ansible playbook.

47
02:05.880 --> 02:10.200
So let's check it out one way we can actually generate this particular hash

48
02:10.200 --> 02:13.240
is directly via the command line utilizing Ansible.

49
02:13.240 --> 02:17.360
So if I just say Ansible and I target the local host, which is my own local

50
02:17.360 --> 02:17.720
machine,

51
02:17.720 --> 02:19.120
that is the control mode.

52
02:19.120 --> 02:22.350
And the module I'll use as a debug module because we just want to print out

53
02:22.350 --> 02:23.040
something

54
02:23.040 --> 02:25.600
and what I want to do is supply an argument.

55
02:25.600 --> 02:27.960
And now I'm going to have my quotation marks.

56
02:27.960 --> 02:32.480
Now, inside of here, I'm going to say MSG, which is the message is equal to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:27.960 --> 02:32.480
Now, inside of here, I'm going to say MSG, which is the message is equal to.

57
02:32.480 --> 02:35.360
And now I'm going to have my double curly braces.

58
02:35.360 --> 02:39.160
Now, inside of here, what I'm going to do is I'm going to supply the actual

59
02:39.160 --> 02:39.600
password

60
02:39.600 --> 02:40.960
that I want to generate the hash for.

61
02:40.960 --> 02:45.720
So within single quotations, I will say the password is going to be Matt one.

62
02:45.720 --> 02:49.720
And what I want to do is I want to use the pipe command because I'm going to

63
02:49.720 --> 02:51.000
use a filter.

64
02:51.000 --> 02:54.680
And the Ansible filter that I'm going to use is one called password hash.

65
02:54.680 --> 02:58.920
Now, inside of parentheses right here, what I'm going to do is specify the

66
02:58.920 --> 03:00.120
actual hashing algorithm,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:58.920 --> 03:00.120
actual hashing algorithm,

67
03:00.120 --> 03:03.640
which in my case here is going to be SHA 512.

68
03:03.640 --> 03:05.480
And then I will close my parentheses.

69
03:05.480 --> 03:06.440
And there we go.

70
03:06.440 --> 03:08.680
So if I hit enter, look at this right here.

71
03:08.680 --> 03:13.350
This is the actual password hash that has been generated for the password, Matt

72
03:13.350 --> 03:13.640
one.

73
03:13.640 --> 03:16.680
So what I'm going to do here is I'm going to copy this right now.

74
03:16.680 --> 03:18.360
OK, so let's copy you.

75
03:18.360 --> 03:20.440
And what I will do is I will create a new playbook.

76
03:20.440 --> 03:23.640
So let's call this play number six dot YML.

77
03:23.640 --> 03:26.520
So I'm going to insert mode, have my three hyphens at the top.

78
03:26.520 --> 03:27.720
Let's give us a name.

79
03:27.720 --> 03:29.000
I'll just say play six.

80
03:29.000 --> 03:30.840
I'll just say testing passwords.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:29.000 --> 03:30.840
I'll just say testing passwords.

81
03:30.840 --> 03:34.520
Now the hosts I will target will be the all group and gather facts.

82
03:34.520 --> 03:35.800
Let's set that to false.

83
03:35.800 --> 03:37.800
And now my tasks are going to be defined.

84
03:37.800 --> 03:39.800
So the very first task is going to have a name.

85
03:39.800 --> 03:43.000
So I'll just say create the user and add a password.

86
03:43.000 --> 03:43.720
Cool.

87
03:43.720 --> 03:46.680
So I'm going to use the answerable built in user module.

88
03:46.680 --> 03:50.840
And what I'm going to supply is the name, which in my case here is going to be

89
03:50.840 --> 03:51.560
Matt's.

90
03:51.560 --> 03:53.480
And the password I'm going to supply.

91
03:53.480 --> 03:55.000
I'll just use a variable value.

92
03:55.000 --> 03:57.880
So I'll have my quotation marks and my double curly braces.

93
03:57.880 --> 04:00.920
And the password I'm going to supply will be password.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:57.880 --> 04:00.920
And the password I'm going to supply will be password.

94
04:00.920 --> 04:02.680
Now this is a variable value here.

95
04:02.680 --> 04:04.920
So what I'm going to do is actually define those variables.

96
04:04.920 --> 04:09.320
So let me just go up to the top right here and I'll just use the vars keyword.

97
04:09.320 --> 04:11.720
And the variable I want to create is one called password.

98
04:11.720 --> 04:12.280
OK.

99
04:12.280 --> 04:15.960
Now inside of here within my quotation marks, all I'm going to do is I'm going

100
04:15.960 --> 04:17.000
to paste in

101
04:17.000 --> 04:18.360
that big long string.

102
04:18.360 --> 04:19.320
Check this out.

103
04:19.320 --> 04:23.080
If I just save this right here and I clear the screen and I just say answerable

104
04:23.080 --> 04:23.720
playbook,

105
04:23.720 --> 04:25.880
play six dot yml and to enter.

106
04:25.880 --> 04:27.880
Oh, and clearly I've made a mistake.

107
04:27.880 --> 04:29.400
Let's go back into this.

108
04:29.400 --> 04:31.400
Notice I've written gather false.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:29.400 --> 04:31.400
Notice I've written gather false.

109
04:31.400 --> 04:34.280
That should be gather facts and set the value to false.

110
04:34.280 --> 04:36.040
That's a little bit of a silly mistake.

111
04:36.040 --> 04:37.000
So I'll try that again.

112
04:37.000 --> 04:39.720
Let's close the screen, arrow up and hit enter.

113
04:39.720 --> 04:40.520
Try again.

114
04:40.520 --> 04:44.040
And as we can see here, we have two changes on the devices.

115
04:44.040 --> 04:45.480
So let's go and check this out then.

116
04:45.480 --> 04:46.680
So we go to the yellow box.

117
04:46.680 --> 04:51.880
If I cat, it's a pass WD, we can see we have the matte user now on the system.

118
04:51.880 --> 04:56.860
And if I say pseudo cat, it's a shadow down the bottom here, we have all of

119
04:56.860 --> 04:57.480
this encrypted

120
04:57.480 --> 04:58.120
password.

121
04:58.120 --> 05:03.000
So the big test is if I just clear the screen and I say SU matte to substitute
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:58.120 --> 05:03.000
So the big test is if I just clear the screen and I say SU matte to substitute

122
05:03.000 --> 05:03.880
user and I

123
05:03.880 --> 05:05.640
now have to type in Matt's password.

124
05:05.640 --> 05:08.120
Let's type in M A T T one.

125
05:08.120 --> 05:08.520
Matt one.

126
05:08.520 --> 05:08.920
OK.

127
05:08.920 --> 05:11.080
So if I hit enter, look at this right here.

128
05:11.080 --> 05:11.640
Who am I?

129
05:11.640 --> 05:12.360
I am now Matt.

130
05:12.360 --> 05:16.360
I was able to authenticate his mat using the mat one password.

131
05:16.360 --> 05:19.960
And similarly, if I slide on over, let's go to the blue box.

132
05:19.960 --> 05:21.560
Again, we should also have a user mat.

133
05:21.560 --> 05:23.000
Let's try to substitute user.

134
05:23.000 --> 05:26.840
If I type in Matt one and to enter, look at this right here.

135
05:26.840 --> 05:28.920
We have also became the mat accounts.

136
05:28.920 --> 05:31.960
Now, let me just show you one other way which we can use to handle this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:28.920 --> 05:31.960
Now, let me just show you one other way which we can use to handle this

137
05:31.960 --> 05:33.080
particular problem.

138
05:33.080 --> 05:36.280
So I'll just say them play seven dot Y mail.

139
05:36.280 --> 05:38.920
So going to insert modes, give the play name.

140
05:38.920 --> 05:40.760
I'll just set another way to create passwords.

141
05:40.760 --> 05:43.640
The host is going to be the all group once again.

142
05:43.640 --> 05:45.240
Gather facts as it falls.

143
05:45.240 --> 05:47.320
And let me just define some variables right here.

144
05:47.320 --> 05:48.920
Let me define a user variable.

145
05:48.920 --> 05:53.640
Let's create a user called Shelly and we get a password called Shelly one.

146
05:53.640 --> 05:57.000
And now create my tasks or just say create user accounts.

147
05:57.000 --> 06:01.160
So the first thing I will do is I'll use the answer will built in user module.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:57.000 --> 06:01.160
So the first thing I will do is I'll use the answer will built in user module.

148
06:01.160 --> 06:05.400
And the name I'm going to apply as the user here is going to be my user

149
06:05.400 --> 06:06.040
variable.

150
06:06.040 --> 06:09.400
So this task here will create the user Shelly.

151
06:09.400 --> 06:13.000
And when that user is created, we want to set the password for the user.

152
06:13.000 --> 06:14.840
So to say set the user's passwords.

153
06:14.840 --> 06:18.520
And this time, what I'm going to do is use the answer will built in shell

154
06:18.520 --> 06:19.080
module.

155
06:19.080 --> 06:21.320
And all I'm going to do here is say echo.

156
06:21.320 --> 06:25.230
And I'm going to take the password variable and I'm going to pipe that into the

157
06:25.230 --> 06:26.040
pass WD

158
06:26.040 --> 06:29.240
command and then say SEDN for standard in.

159
06:29.240 --> 06:32.280
And then I'm going to supply the user that I want to apply this to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:29.240 --> 06:32.280
And then I'm going to supply the user that I want to apply this to.

160
06:32.280 --> 06:35.640
So basically what this will do, it will take the Shelly one password,

161
06:35.640 --> 06:39.490
throw through the hashing algorithm and assign it to the user of Shelly right

162
06:39.490 --> 06:40.040
here.

163
06:40.040 --> 06:42.760
So let's escape colon WQ to write in quits.

164
06:42.760 --> 06:46.200
Let's say answer will play book play seven dot YML and to enter.

165
06:46.200 --> 06:47.160
Let's give it a moment.

166
06:47.160 --> 06:50.040
And as we can see here, we have our changes.

167
06:50.040 --> 06:52.280
So let's go to our devices to confirm.

168
06:52.280 --> 06:56.040
So let's just do our cat of Etsy pass WD.

169
06:56.040 --> 06:58.440
We can see we have the Shelly user down the bottom.

170
06:58.440 --> 07:02.200
And if we cat the Etsy shadow, oh, of course, so do we need for that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:58.440 --> 07:02.200
And if we cat the Etsy shadow, oh, of course, so do we need for that.

171
07:02.200 --> 07:04.280
So so do cats, Etsy shadow.

172
07:04.280 --> 07:06.200
And down the bottom here, check this out.

173
07:06.200 --> 07:08.200
We actually have the hash password for Shelly.

174
07:08.200 --> 07:11.160
So what I will do here is clear the screen and try to log in,

175
07:11.160 --> 07:13.880
so I'll substitute user and become Shelly.

176
07:13.880 --> 07:17.960
And if I type in Shelly one and to enter, look at this right here.

177
07:17.960 --> 07:21.000
We have correctly authenticated as the Shelly user.

178
07:21.000 --> 07:24.680
And the same thing is true over on the blue box device.