So friends, in this particular video, what I want to highlight to you is how we
can utilize
Ansible to manage our SSH connections. So you may recall at the very beginning
of this course,
we set up passwordless authentication. And we did that by generating particular
keys and copying
those keys directly to our managed devices. Now, of course, you can do this any
more manual way,
just by going to each device one by one by one, and copying over the keys,
allowing you to get
that passwordless authentication. But as we know, we have this Ansible system. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that passwordless authentication. But as we know, we have this Ansible system.
And if we can
distribute these keys on mass at once, then this is obviously a much better
solution. So let's look
at how we can actually do such a thing. So right now, if I just say SSH Ansible
, which is the user
name, which is a username on both of my devices, and I target one of my devices
such as yellow
box, if I hit enter, notice I don't actually have to provide any password. I
can just say who am I,
we can do in C, I am on my other device, my managed device. So let's exit back
out, we come back.
And similarly, I could also log in to the blue box in the same way without a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And similarly, I could also log in to the blue box in the same way without a
password,
do an IP adder, we can see we are now on a different machine. And again, we
exit back out to go back
to our control node. However, if I happen to remove the configurations, let's
go in here onto the
yellow box, if I just say substitute user Ansible, and I type in the password
of Ansible, if I cd to
my home directory, and I do an LS dash LA, we see we have this hidden directory
called dot SSH. And
if I go inside, if you're doing LS, here we have this particular file here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if I go inside, if you're doing LS, here we have this particular file here
authorized keys. And if
I happen to cat this, this is where it stores all the information about those
keys. And we can see
here we have the actual key for Ansible at red box, that's if I want to log in
from red box,
I have my keys set up. Now, what if I do this, if I just remove this particular
file, I will no
longer be able to log in to the yellow box without having to provide a password
. So again, let's go
and test that. So we'll try to SSH into the yellow box. Look at this now, we
actually have to provide
a password. Now I can do that by typing the word Ansible, and now I get access. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a password. Now I can do that by typing the word Ansible, and now I get access.
There's similar
left I go to my blue box substitute user become Ansible, typing the Ansible
password cd to the
Ansible home directory, going to the hidden directory of SSH, doing LS, there's
our authorized keys and
let's remove them once again, we go back to the control nodes. If I try to SSH
into the blue box,
I now have to type the password, you see that. So that means if I try to run an
Ansible playbook
right now, such as let's maybe say play one, and I type in play one and to
enter, as we can see
here, we get permission denied, I'd actually have to say dash key to prompt me WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here, we get permission denied, I'd actually have to say dash key to prompt me
for a password,
and then provide the password on every playbook run. And now we can log in as
we can see here.
Now we want to set up the same configuration that we had before. This time
though, we want to
imagine we're on a very large network, and we don't want to have to do manually
. This time we want
to set things up using Ansible itself. So let's talk about how to do that. So
if I Google for
Ansible authorized key module, if I click this right here, this is not a built
in module, it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in module, it's
not part of Ansible core. As we can see here, it says this module is part of
the Ansible
POSIX collection. This is why we installed that collection at the beginning of
this particular
scale. So the way we use it in the playbook is going to be Ansible dot POSIX
dot authorized key.
And if we scroll on down, we can see some parameters. So an important one to
specify if we scroll on
down, is this require parameter, which is the key parameter. This is the public
key that we want
to actually provide. Similarly, if I scroll on down a little bit further, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to actually provide. Similarly, if I scroll on down a little bit further, we
also have another
require parameter that is the user parameter. This is going to be the user name
that is associated
with that particular key. So let's check this out now. If I go back to my
control node, and what I
will do is I'll create a playbook called play five dot YML. So let's go inside
of here. So we'll
go into insert mode, have our three hyphens at the top. Let's give this
playbook a name, just say play
five setting up SSH. Here we're going to target, we're going to target the all
groups, and we will
just say gather facts is equal to the value false, don't need to do that. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just say gather facts is equal to the value false, don't need to do that. And
now we will define
our tasks. So this task here is going to be copying the public key to the
targets. Now we're going to
use the Ansible POSIX authorized key module. And we're going to have to supply
two particular
parameters. The first one is the user, which in this case here, we're going to
use the Ansible
user that is user we want to be able to log in with without providing a
password. And now we're
going to have to specify the key. Now what I'm going to do here is use
something known as a
plugin. This is the lookup plugin. It's going to allow me to look up a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
plugin. This is the lookup plugin. It's going to allow me to look up a
particular file. And the
syntax is as follows, we're going to have our double curly braces right here.
And inside of that,
I'm going to specify I'm going to use the lookup plugin. And then within
parentheses,
I'm going to supply two different arguments. The first is an quotation marks
that is single
quotation marks, by the way. And I'm going to specify that I'm going to look up
a file. And
then I have a comma. Now I supply my second arguments. So now I have to supply
the path of the
particular file that I want to copy over. Now if I just write and quit from now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
particular file that I want to copy over. Now if I just write and quit from now
, so if I do a PWD,
we can see that in the Ansible home directory, if I do an LS dash a to show my
hidden directories,
we can indeed see we have this hidden dot SSH directory. And if we go inside of
here,
doing LS is here is the key that I want to copy over the ID RSA PUBKEY.
Remember the public one,
we do not copy over the private one. So inside of this particular file, this is
the key I want
to copy. So check this out. Let's go back into play number five and answer. I
specify the one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specify the one
to lookup a file. And all I need to do now is to provide the path to that
particular file. So I'll
say home, Ansible dot SSH. And then it's going to be ID underscore RSA dot pub
kill. So let's just
copy this over. And again, just before I run this as a quick test, let's try to
SSH into Ansible
as a user into the yellow box. Again, we're still prompt of the password.
However, when I now run
this playbook, so I'll say Ansible playbook, playbook five dot YML and I'll say
dash K to prompt me WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
dash K to prompt me
for the password to initially log in, I'll supply that password of Ansible and
to answer, give it a
moment. And now we can see here, we have copied over the public key to the
targets. Now, if I just
arrow up and I tried to SSH into Ansible and hit enter, straight away, we'll
log in without
the password. And again, if I exit back out, we've done the same thing with the
blue box,
because we have successfully copied over those public keys. So let's just hit
enter. Once again,
we're now in the blue box, you see that? And just to verify if I go back to my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're now in the blue box, you see that? And just to verify if I go back to my
divisor right here,
and then my home directory, I go into my hidden directory of SSH to an LS, we
can now see here,
we have once again got the authorized keys that we previously deleted. And
again, I can just
cat that's open, there we are right there.