Hello, in today's video presentation, we will provision a user and ssh key using Ansible
against an Oracle Linux 8 system.
The demo system used today is the Oracle Linux 8 vagrant box image.
This image uses the default user vagrant and allows passwordless ssh access by an auto-generated
ssh key.
We will provision a new user, oracle, and add a public ssh key generated on our host
for key-based ssh authentication.
The prerequisites for this demo include downloading the Oracle Vagrant Boxes from GitHub plus
install and configure VirtualBox, Vagrant, and Ansible on your host.
So let us get started.
First, create a working directory for this demo, if you do not have one already.
On my host, I created the directory ol8-stage in my home folder using the command mkdir
~/demo/ol8-stage.
Change to the Oracle Linux 8 directory where you cloned the Oracle Vagrant Boxes repository.
Since I cloned the repository to my ~/git folder, the Oracle Linux 8 is in ~/git/vagrant-boxes/OracleLinux/8.
Copy the Vagrantfile to your ~/demo/ol8-stage working directory.
Change to your working directory using cd ~/demo/ol8-stage.
Due to our testing, we will need to make some changes to the Vagrantfile.
In my working environment, I have the vagrant-vbguest plugin installed.
Show this by typing vagrant plugin list to display a list of your installed vagrant plugins.
This plugin is excellent for making sure the VirtualBox Guest Additions are current when
started.
However, this can cause extra delays in the machine startup time.
To fix this and a few additional items, we need to edit the Vagrantfile.
I am using vim in this demo.
Below the line config.vm.box_check_update = false, I
will add config.vbguest.auto_update = false line to avoid attempting to update the VirtualBox
Guest Additions during startup.
Next, remove or comment out the config.vm.provision "shell" and :reload entries toward the end
of the file.
Lastly, add the Ansible provisioning steps: config.vm.provision "ansible" do |ansible|
ansible.playbook = "playbook.yml" end
Vagrant will use Ansible to provision the system using a playbook called playbook.yml,
which we will create.
Save and close the Vagrantfile.
Create a new Ansible playbook using touch playbook.yml.
Open the file for editing with vim.
For ease, I will copy in the contents of this file, and we will review it.
You might want to pause playback so you can copy the contents.
The playbook.yml is a standard YAML file.
The hosts: all line indicates that this playbook applies to all hosts.
The become: yes line means to become root
Next, we will cover some tasks.
Each task starts with an indent - name: a string of text describing the task.
For this demo, we focus on the user task and authorized_key task.
In the user task, we create the user oracle, set the password to oracle, and assign this
new user to the wheel group for sudo access.
The append: yes instructs to append to the user's group list rather than replace it with
only those groups listed in the groups: wheel line.
The update_password: on_create only sets the password during account creation.
If update_password: always is set instead, then the password would be reset to oracle
each time the playbook runs.
In the Ansible user module, the state: value defaults to present.
This default setting causes the playbook first to check if the user exists.
If the user account is not present, Ansible creates the user account based on the criteria
defined.
In the authorized_key task, we tell which user to assign the key, and where to get the
key.
The user: oracle line puts the key in the oracle user's .ssh/authorized_keys file.
The state: present does the check to execute this task only if the key is not already in
existence.
The key: key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}" instructs Ansible
to look for the given file name on my host system from where the playbook is being run
and copy the contents.
Save and close the playbook.yml file.
The last step, if you do not already have one, is to create an ssh key matching the
name used in your playbook.
Accomplish this with ssh-keygen -t rsa.
With the playbook and ssh key ready, we can start the machine.
Executing vagrant up from within the same working directory where we created the Vagrantfile
and playbook will download the latest Oracle Linux 8 box image if not already on the system
and then start and provision your machine.
With the machine up and running, execute the vagrant ssh-config command to get your ssh
connection details.
We are mostly interested in the HostName and Port line items as we will be using the user
oracle and ssh public key we provisioned.
Test that the user and key provisioned successfully by running ssh -p Port oracle@Hostname
If this is the first time connecting with the Hostname, you will get a prompt to accept
the host fingerprint.
Since I have rebuilt this demo many times, and each time it has a different fingerprint,
the fingerprint that exists fails.
Clear that fingerprint with ssh-keygen -R Hostname and try again.
Accept the fingerprint with yes.
You are connected, thus validating our provisioning steps worked.