Ansible is a tool for managing a large number of servers centrally. With Ansible playbooks, you can create automated tasks to run against your servers remotely from a central control node. Installing Ansible on Ubuntu requires the following prerequisites and installation commands to be followed promptly.

1. Root privilege.

ansible@ansible-VirtualBox:~$ sudo -i
[sudo] password for ansible:
root@ansible-VirtualBox:~#

2. Install update packages and upgrades

root@ansible-VirtualBox:/# apt-get update && apt-get upgrade

3. One of those many ways to get Ansible running for Ubuntu is to install the project’s PPA (personal package archive), i.e the software-properties-common to your server.

root@ansible-VirtualBox:~# apt-get install software-properties-common
Reading package lists… Done
Building dependency tree
Reading state information… Done
software-properties-common is already the newest version (0.96.20.1).
software-properties-common set to manually installed.
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

4. After installing this package, add the Ansible PPA from the repository using this command.

root@ansible-VirtualBox:~# apt-add-repository ppa:ansible/ansible

Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy. Avoid writing scripts or custom code to deploy and update your applications‚ automate in a language that approaches plain English, using SSH, with no agents to install on remote systems.

http://ansible.com/
More info: https://launchpad.net/~ansible/+archive/ubuntu/ansible
Press [ENTER] to continue or ctrl-c to cancel adding it

gpg: keyring `/tmp/tmpooow5ue_/secring.gpg' created
gpg: keyring `/tmp/tmpooow5ue_/pubring.gpg' created
gpg: requesting key 7BB9C367 from hkp server keyserver.ubuntu.com
gpg: /tmp/tmpooow5ue_/trustdb.gpg: trustdb created
gpg: key 7BB9C367: public key "Launchpad PPA for Ansible, Inc." imported
gpg: Total number processed: 1
gpg: imported: 1  (RSA: 1)                                  
OK

Note: where you have to press enter to accept the PPA added process to continue.

5. Once again, run the apt-get update utility to have the system package refreshed to be aware of the newly added PPA.

root@ansible-VirtualBox:/# apt-get update

6. Now install Ansible software.

root@ansible-VirtualBox:/# apt-get install ansi
ansible ansible-fireball ansible-node-fireball ansiweather

root@ansible-VirtualBox:/# apt-get install ansible
Reading package lists… Done
Building dependency tree
Reading state information… Done
The following additional packages will be installed:
python-crypto python-ecdsa python-httplib2 python-jinja2 python-markupsafe python-paramiko
python-pkg-resources python-setuptools python-six python-yaml sshpass
Suggested packages:
python-crypto-dbg python-crypto-doc python-jinja2-doc python-setuptools-doc
The following NEW packages will be installed:
ansible python-crypto python-ecdsa python-httplib2 python-jinja2 python-markupsafe
python-paramiko python-pkg-resources python-setuptools python-six python-yaml sshpass
0 upgraded, 12 newly installed, 0 to remove and 3 not upgraded.
Need to get 2.182 kB of archives.
After this operation, 13,8 MB of additional disk space will be used.
Do you want to continue? [Y/n]

Note: Just hit enter of “y” key to continue with the installation.

7. SSH Key Setup: SSH keys allow communication (auth) between two hosts without the need for a password. SSH key authentication uses two keys, a private key, and a public key.

Ansible communicates with servers via SSH on Linux. While it certainly has the ability to handle password-based, SSH authentication keys help keep things simple. Simplay enter the following command to generate for you the keys using RSA algorithm

root@ansible-VirtualBox:~# ssh
Note: I used the tab key to display all available options

ssh               ssh-argv0         ssh-import-id     ssh-keygen        
ssh-add           ssh-copy-id       ssh-import-id-gh  ssh-keyscan       
ssh-agent         sshd              ssh-import-id-lp  sshpass   

Note: The step starts from here. During the process you will be prompted for a password, keep hitting the enter button to create the key.

root@ansible-VirtualBox:~# ssh-keygen -t rsa -K4096
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:3DLxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxE8yGA root@ansible-VirtualBox
The key's randomart image is:
+---[RSA 2048]----+
|    .oo..        |
|    .. o.o       |
|   . ..+*.       |
|    + .+==       |
|   . o .S.+ ..   |
|.Eo . =  +.o...  |
|.+ + = .  o=oB . |
|  o =      o@.=  |
|     .       =.  |
+----[SHA256]-----+

Note the following

• Now you have the RSA key generated.
• If you already have an SSH key pair, simply copy this to the specified path of the machine running Ansible (~/.ssh/id_rsa.pub)
• By default, the public key is saved in the file ~/.ssh/id_rsa.pub,
• while the private key is saved in ~/.ssh/id_rsa
• Not important for this task but vital to add more users.
  
  Now copy the id_rsa.pub file to the remote host and append it to ~/.ssh/authorized_keys
  
  This step is necessary if you wish to have needed other users to administer ansible to connect to these machines.
  
  Now copy the id_rsa.pub file to the remote host and append it to ~/.ssh/authorized_keys using this command:

root@ansible-VirtualBox:~# ssh-copy-id username@remotehost

where remotehost is the IP address or FQDN of the server and username is the “root” or whatsoever name you have configured for the other machine.

Finally, double-check the permissions on the authorized_keys file, only the authenticated user should have read and write permissions. If the permissions are not correct to change them by.

Now assign permission: You should now be able to SSH to the host without being prompted for a password.

root@ansible-VirtualBox:~#chmod 600 .ssh/authorized_keys

To get (view) the public key run this command

root@ansible-VirtualBox:~# cat ~/.ssh/id_rsa.pub
ssh-rsa AAAAxxxxxxxxxxxxxxxxxxxxNxfz5NxxxxxxxxxxxRUVxxxxxxxx root@ansible-VirtualBox
root@ansible-VirtualBox:~#

To view where your hidden files are kept you use

root@ansible-VirtualBox:/etc# cd ~/.ssh
root@ansible-VirtualBox:~/.ssh# ls
id_rsa id_rsa.pub

To view the private keys, use any of the editor

root@ansible-VirtualBox:~/.ssh# vi id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEpgIBAAKCAQEAyUZdGaqwHoxPb9XVXDN142xvrJN9gvKp6VSqZoIpEYw8LTlExxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx6w860wHVDdx/n1tDJqVjM0DJxGJwMJoC9QHejiSjJnz/SJkPB22/BDbuY4/l9tFYWSs+Ih9aekcRwg9KNtRelC8r5j0Vt1Qt3X4GB0q9qZ+hZC5EK219
-----END RSA PRIVATE KEY-----

Note: Make sure that you include the first and last marker lines. They are required in order for the key file to be valid and change permission if necessary.

To view the public key, run the same command but with the .pub

root@ansible-VirtualBox:~/.ssh# vi id_rsa.pub

8. Configuring Ansible Hosts:
As we all know, Ansible keeps track of all the servers it knows via a file called “Hosts” file. This needs to be configured (entered) before it will be able to communicate with other computers.
this is how it looks.

root@ansible-VirtualBox:/etc/ansible# ls
ansible.cfg hosts roles

root@ansible-VirtualBox:/etc/ansible# vi hosts
# This is the default ansible 'hosts' file.
#
# It should live in /etc/ansible/hosts
#
#   - Comments begin with the '#' character
#   - Blank lines are ignored
#   - Groups of hosts are delimited by [header] elements
#   - You can enter hostnames or ip addresses
#   - A hostname/ip can be a member of multiple groups

# Ex 1: Ungrouped hosts, specify before any group headers.

## green.example.com
## blue.example.com
## 192.168.100.1
## 192.168.100.10

# Ex 2: A collection of hosts belonging to the 'webservers' group

## [webservers]
## alpha.example.org
## beta.example.org
## 192.168.1.100
## 192.168.1.110

# If you have multiple hosts following a pattern you can specify
# them like this:

## www[001:006].example.com

# Ex 3: A collection of database servers in the 'dbservers' group

## [dbservers]
##
## db01.intranet.mydomain.net
## db02.intranet.mydomain.net
## 10.25.1.56
## 10.25.1.57

# Here's another example of host ranges, this time there are no
# leading 0s:

## db-[99:101]-node.example.co

Note: These are just configuration examples. None will work except they are commented out, i.e, by deleting the # symbol and adding the right devices (IP address) are added.

To do this, you have to uncomment them out and enter the idea ip address(es).

[monitoringservers]
alpha.example.org
beta.example.org
192.168.1.100
192.168.1.110
192.168.177.13

Note the following steps below.
Method 1: On how to copy the SSH public key to remote servers
– Step 1: Always remember to copy the ssh public key from the ansible machine to the server you wish to manage.

root@ansible-VirtualBox:/etc# cd ~/.ssh
root@ansible-VirtualBox:~/.ssh# ls
id_rsa id_rsa.pub known_hosts
root@ansible-VirtualBox:~/.ssh# vim id_rsa.pub

And copy the key!!!

– Step 2: Create a file called authorized_keys on the target machine you wish to use ansible on. the in the authorized_keys create copy and paste the public of the Ansible server in it.

Note: This has to be in the home directory of the ssh user which is without the bracket (~/.ssh). it should look this way.

Webserver@nagios:~$ vi .ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJRl0Zq

Note 2: http://docs.ansible.com/ansible/apt_module.html
Also, install the python-apt library on the target machine you wish to administer Ansible on, e.g., my Nagios server

Webserver@nagios:~$ sudo apt-get install python-apt
Webserver@nagios:~$ sudo apt-get install aptitude

or use a single command (any of these)

- Webserver@nagios:~$ sudo apt-get install python-apt; apt-get install aptitude
- Webserver@nagios:~$ sudo apt-get install python-apt && apt-get install aptitude
- Webserver@nagios:~$ sudo apt-get install python-apt || apt-get install aptitude

Note: Without this, it will fail if we want to do some package installations.

Method 2: This method seems to be the easiest way to copy the ssh public key from the ansible machine to the server you wish to manage.

root@ansible-VirtualBox:~/.ssh# ssh
ssh               ssh-argv0         ssh-import-id     ssh-keygen        
ssh-add           ssh-copy-id       ssh-import-id-gh  ssh-keyscan       
ssh-agent         sshd              ssh-import-id-lp  sshpass    

root@ansible-VirtualBox:~/.ssh# ssh-copy-id webserver@192.168.xxx.1x

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
webserver@192.168.xxx.xx's password:

Number of key(s) added: 1

Now try logging into the machine, with: “ssh ‘webserver@192.168.xxx.1x'”
and check to make sure that only the key(s) you wanted were added.

Note: This method has copied the public key to the server you wish to administer. now to see the key on the other server use this command

webserver@nagios:~$ cat .ssh/authorized_keys
ssh-rsa yc2EAAxxxxxxxxxxxxxxxxxxxxxxxDJRl0Zqrxxxxxxxxxxxxxxxxxxxxxxxx
root@ansible-VirtualBox:~/.ssh#

9. After defining your host file in step 8 above

root@ansible-VirtualBox:/etc/ansible# vi hosts
[monitoringservers]
## alpha.example.org
## beta.example.org
## 192.168.1.100
## 192.168.1.110
192.168.177.13 ansible_user=webserver

Let’s do some ping testing

Example 1:
root@ansible-VirtualBox:/etc/ansible# ansible monitoringservers -m ping

This will display the number of servers with IP address it successfully pinged.
192.168.xxx.1x | SUCCESS => {
"changed": false,
"ping": "pong"
}

Note: It shows it is using the module called ping, signified by -m to ping all the available servers in the group of monitoring servers.

root@ansible-VirtualBox:/etc/ansible# ansible -i hosts monitoringservers -m ping
192.168.xxx.1x | SUCCESS => {
"changed": false,
"ping": "pong

Here, a hosts is added and it delivers the same output.

Useful link
– https://www.linode.com/docs/applications/ansible/getting-started-with-ansible

This is one of the famous configuration management (Orchestration) tools in existence today. Ansible is an agentless, powerful automation that enables you to deliver configurations, deployment across your IT environment. Configuration management systems are designed to make controlling large numbers of servers easy for administrator’s teams. They allow you to control many different systems in an automated way from one central location. Here are examples of other configuration Tools.

- Chef
- Puppet
- Salt
- CFEngine etc.

Traditionally, Ansible is more focused on Linux, but with Microsoft support of Open Source and adoption lately, Windows Support for Ansible is possible. Ansible’s native Windows support uses Windows PowerShell remoting to manage Windows in the same way that Ansible manages Linux.

Ansible allows the administration of Windows using local or domain users. Here is Ansible’s native Windows support; you can, out of the box.

- Gather facts on Windows hosts
- Manage and install Windows updates
- Fetch files from remote sites
- Push and execute any PowerShell scripts you write
- Install and uninstall MSIs
- Enable and disable Windows Features
- Start, stop, and manage Windows services
- Create and manage local users and groups
- Manage Windows packages via the Chocolatey package manager https://chocolatey.org/

Ansible’s easy extensibility, enables you can write your own modules in PowerShell and extend Ansible for whatever other functionality you need for your environment.

Host requirements: For Ansible to manage Windows effectively, the following has to be followed.
– Windows version: Supports Windows 10, Windows Server 2016 and 2019.
– Ansible requires PowerShell 3.0 or newer and at least .NET 4.0 to be installed on the OS.
– It requires WinRM listener be created and activated

Note: If your base image (OS images) does not meet PowerShell 3.0, this can be upgraded.

What is WinRM: Windows Remote Management (WinRM) is the Microsoft implementation of the WS-Management Protocol, a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows hardware and operating systems, from different vendors, to interoperate. The WS-Management protocol specification provides a common way for systems to access and exchange management information across an IT infrastructure.

In other terms, WinRM is a management protocol used by Windows to remotely communicate with other servers.

Note: WinRM does everything which can be performed remotely by WMI and RPC. With this distinction that there are no proprietary RPC calls over TCP, but are handled via HTTP port 80 or 443. You can configure additional listeners, which then accept connections by default on ports 5985 HTTPS 5986. For the administration “over the Internet” exactly one port is sufficient and even via proxy server a connection is usually possible. For more information, see http://www.winfaq.de/faq_html/Content/tip2000/onlinefaq.php?h=tip2495.htm

Note: When running PowerShell 3.0, ensure you pay attention to the known bug, (that limits the memory available to WinRM that result in Ansible failing to execute certain code on Windows devices) by applying the hot-fix. See link to the fix https://github.com/jborean93/ansible-windows/blob/master/scripts/Install-WMF3Hotfix.ps1

Setup the WinRM
When the PowerShell prerequisite is met; ensure to install the WinRM in order to allow Ansible to connect to it. The WinRM service has two components that enable Ansible to interface with Windows, the configuration settings are as follow;

• Listener and
• Service

See an example setup script to configure HTTP and HTTPs Listeners. This script as stated by Ansible uses a self-signed certificate and enables basic authentication only. Therefore it is not a good solution for a production https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1

WinRM Listener:  This service listens to request on one or more ports.
Note: This one or more port can have the listener created and configured on them.

– This is how to view the current listeners that are running on the WinRM service, run the cmd execute the command without the quotes included. “ winrm enumerate winrm/config/Listener”

See documentation on how to create WinRM listener via PowerShell (ensure to provide the certificate thumbprint). https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html#configuring-ansible-for-ssh-on-windows

How does Ansible work?
Ansible works by configuring remote devices from a central device that has Ansible software installed. It has a simple architecture and communicates over normal SSH channels for Unix systems or WinRM for Windows systems in order to retrieve information from remote machines, to execute the automation tasks and YAML files to define provisioning details (issue commands) etc.

Note: Ansible does not require any additional software installed on the remote (client) devices. With the SSH or WinRM port exposed, servers (remote devices) can be configured.

Windows SSH Setup:
Install the Win32-OpenSSH service installed on your device https://github.com/PowerShell/Win32-OpenSSH

• For installation recommendation from Microsoft, see https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH

There are other ways such as using Chocolatey etc.

Configure the Win32-OpenSSH shell. By default Win32-OpenSSH will use cmd.exe as a shell. To configure a different shell, use an Ansible task to define the registry setting: See how this is done in the link below. The following scenarios and use the link below for configuration as well.
– The Win32-OpenSSH Authentication method
– Set the connection variable for Ansible for SSH

Chef Automate provides a full suite of enterprise capabilities for workflow, node visibility and compliance. Chef Automate integrates with the open-source products Chef, InSpec and Habitat. Chef Automate comes with comprehensive 24×7 support services for the entire platform, including open source components.

Workflow
Chef Automate includes a pipeline for continuous delivery of infrastructure and applications. This full-stack approach, where infrastructure changes are delivered in tandem with any application changes, allows for safe deployment at high velocity.

Chef Automate gives you a data warehouse that accepts input from Chef, Habitat, and Chef Automate workflow and compliance. It provides views into operational and workflow events. There is a query language available through the UI and customisable dashboards.

Here is an example of the Chef Automate dashboard.

High Availability
Chef Automate has a high-availability Chef server option for fault tolerance, immediately consistent search results, and accurate real-time data about your infrastructure. Chef Automate also provides a graphical management console for the Chef server

Compliance
Chef Automate creates customizable reports that identify compliance issues, security risks, and outdated software. You can write your own compliance rules in InSpec, or you can get started quickly by using built-in profiles, which are predefined rule sets for a variety of security frameworks, such as Center for Internet Security (CIS) benchmarks, included as part of Chef Automate.

Compliance reporting is currently done through two mechanisms: The integrated compliance reporting in Chef Automate 0.8.5 or later, and the standalone Chef Compliance server.

https://docs.chef.io/chef_automate_compliance.html
https://docs.chef.io/chef_compliance.html
https://docs.chef.io/platform_overview.html