It’s cause I’m Lazy (and that’s a good thing)

If you are in the world of IT or have picked up the unfortunate hobby of self hosting, I’m confident there is this one painful task that is too frequently required that is making you shiver right now just thinking about it. Securing a new VPS brought dread to me because of the whole, “SSH scans started 4 seconds ago”, thing. Notice I used past tense there because not anymore baby, I can churn secured VPS’s like they owe me money (because they do, they cost me money)! While studying for the CCNA the section on network automation inspired me to do sit down with the documentation and solve a real problem for myself. It’s amazing what a fifth grade reading level and two hours of your undivided attention can accomplish. Below I will be sharing my learning process and hope to serve you as an Ansible quick start guide with a suggested workflow if you are new. I will also include the playbook I made to secure fresh VPS’s and serve as a POC that I really can read. I recommend you follow along thorough the documentation from the start as you read.

Install and Inventories

After you get through terminology you will of course be conveniently presented with the shell commands for install to paste into your terminal. Seeing pip install might make you sweat, but rest assured that I did not have to go through such troubles being an Omarchy user. Seriously though if there are issues when you use pip I cannot speak on that other than set up a virtualenv first. The first real task is understanding inventories, specifically how to build inventories to scale. Of course you can continue to write a list of your hosts by IP address alone, but that probably won’t work well unless each device is the exact same. For instance, if you were only concerned with the mass provisioning of switches that had the exact same configuration. With that being said, this is one of the parts where you putting in the extra time to structure your inventory is an investment to avoid painful work in the future. Best advice is creating your “metagroups” in layman’s terms or their function. The What, Where, and When they provide is an excellent litmus test/framework. Mirror yours from the examples shown in the documentation. My first entry ended up looking like this,

[myhosts]
<IP ADDRESS> ansible_user=<USER> ansible_ssh_pass=<PLAINTEXT CRED> ansible_sudo_pass=<PLAINTEXT CRED> 

Credentials for Hosts?

Of course this page emphasizes the whole security aspect of cyber security and with that comes not hard coding your credentials. Here are three different approaches, either A encrypt the entire inventory file, B encrypt only the passwords, or C make a vault password file.

Option A - Encrypt the Entire Inventory

The command to do this is,

ansible-vault encrypt inventory.ini

This will prompt you for a vault password and from there on out it is unreadable in plain text.

To run a playbook with the encrypted inventory,

ansible-playbook playbook.yaml -i inventory.ini --ask-vault-pass

To edit your encrypted inventory,

ansible-vault edit inventory.ini

Option B - Encrypt the Passwords as Variables

This is the professional approach when you have several different groups (switches, routers, app servers, or NAS’s) where you separate the credentials from the inventory.ini by placing them in the vault. You would then have a directory for each host or group of hosts under a say host_vars/ directory if that is what you decided to name the variable in the inventory.ini like below.

inventory.ini
host_vars/
  203.0.113.10/
    vault.yml

inventory.invi will look like this,

[myhosts]
203.0.113.10 ansible_user=root

You create the vault file like so,

ansible-vault create host_vars/203.0.113.10/vault.yml

which opens your default text editor so that you may enter the ssh user pass like so,

ansible_ssh_pass: yourpassword

Option C - Vault Password File

With this option you avoid having to enter in your vault password every time and once you create the vault_pass.txt (or name it secret_sauce.txt doesn’t matter), you can then add it to the ansible.cfg file. Remember to use YAML formatting like above when entering the user creds.

echo "yourvaultpassword" > ~/.vault_pass.txt
chmod 600 ~/.vault_pass.txt

Then run,

ansible-playbook playbook.yaml -i inventory.ini --vault-password-file ~/.vault_pass.txt

Here is the ansible.cfg entry I mentioned.

[defaults]
vault_password_file = ~/.vault_pass.txt

Workflow for Success Using Ansible

Now that the inventory and credentials are out of the way we can begin creating playbooks, but how do you know what to type? Firstly, if you are new to YAML they offer a quick overview that is sufficient for what you’ll need to know for playbooks (https://docs.ansible.com/projects/ansible/latest/reference_appendices/YAMLSyntax.html).

To best explain, here is an example task that will enable SSH using UFW on my remote host,

     - name: Enable SSH through UFW
     community.general.ufw:
      rule: allow
      port: 'ssh'
      proto: tcp

Now the docs will explain the structure where you learn that “community.general.ufw” is the module name for UFW. Every module has its own documentation which you can learn by using this command,

ansible-doc ufw

In short, the workflow I utilized because I didn’t know the exact way to reference a module that fulfilled a task for me is searching for the modules offline in the command line with,

ansible-doc l    # lists all modules

and appending grep to it if I was unsure of the actual name, but knew the name of the binary or function I was attempting to fulfil. For example, I know I need to install a software using apt, but I don’t know the module name to then read the docs for syntax so I’ll just hit em with a good ol grep,

ansible-doc -l | grep apt

If I really couldn’t find it I would just hit up a search or Claude. The best part about the ansible docs is that each module has example playbook entries towards the bottom. Can you believe how far a fifth grade reading level can get you? This all took me around three hours between all the reading, typing, and scavenging for modules/syntax before deploying the playbook. The only other piece of advice I have to make this easier is to utilize a text editor that will highlight syntax, in my Neo Vim I have a plugin that does that. The docs recommend using Vs Code along with some ansible plugin that will autocomplete module names so if you aren’t purposely making your life hard I would highly recommend following that route as well. The relevant links below have the online index of all modules, but command line is way cooler so don’t even think about it. The two playbooks I used for securing a new VPS as well as creating an SSL cert for a web server are available to download.

secure_new_vps_playbook.yaml
SHA256 Hash b170e8426a99e07cb476b6d3750a9bb0001b529c2f531b0623d6acf37a60e5b4

install_apache_wSSL.yaml
SHA256 Hash 277c06dea475713f7c5fe6dec194b1b3a2ca96ce7f05a4fb45ec3089be58ee27

Relevant Links

https://docs.ansible.com/projects/ansible/latest/getting_started/index.html https://docs.ansible.com/projects/ansible/latest/collections/index_module.html https://yaml.org/spec/1.2.2/ https://docs.ansible.com/projects/ansible/latest/reference_appendices/YAMLSyntax.html