Prepare a managed node

Managed nodes are the systems listed in the inventory and which are configured by the control node according to the playbook. You do not have to install Ansible on managed hosts.

Before you begin

  • You prepared the control node. For more information, see Preparing a control node on RHEL 10.
  • You have SSH access from the control node. Important

    Direct SSH access as the root user is a security risk. To reduce this risk, create a local user on this node and configure a sudo policy when preparing a managed node. Ansible on the control node can then use the local user account to log in to the managed node and run playbooks as different users, such as root.

Procedure

  1. Create a user named ansible: 
    [root@managed-node-01]# useradd ansible

    The control node later uses this user to establish an SSH connection to this host.

  2. Set a password for the ansible user: 
    [root@managed-node-01]# passwd ansible
     
    Changing password for user ansible.
New password: <password>
Retype new password: <password>
passwd: all authentication tokens updated successfully.

    You must enter this password when Ansible uses sudo to perform tasks as the root user.

  3. Install the ansible user’s SSH public key on the managed node:
    1. Log in to the control node as the ansible user, and copy the SSH public key to the managed node: 
      [ansible@control-node]$ ssh-copy-id managed-node-01.example.com
       
      /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/ansible/.ssh/id_rsa.pub"
The authenticity of host 'managed-node-01.example.com (192.0.2.100)' can't be established.
ECDSA key fingerprint is SHA256:9bZ33GJNODK3zbNhybokN/6Mq7hu3vpBXDrCxe7NAvo.
    2. When prompted, connect by entering yes: 
      Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
    3. When prompted, enter the password: 
      ansible@managed-node-01.example.com's password: <password>

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'managed-node-01.example.com'"
and check to make sure that only the key(s) you wanted were added.
    4. Verify the SSH connection by remotely running a command on the control node: 
      [ansible@control-node]$ ssh managed-node-01.example.com whoami
       
      ansible
  4. Create a sudo configuration for the ansible user:
    1. Create and edit the /etc/sudoers.d/ansible file by using the visudo command: 
      [root@managed-node-01]# visudo /etc/sudoers.d/ansible

      The benefit of using visudo over a normal editor is that this utility provides basic checks, such as for parse errors, before installing the file.

    2. Configure a sudoers policy in the /etc/sudoers.d/ansible file that meets your requirements, for example:
      • To grant permissions to the ansible user to run all commands as any user and group on this host after entering the ansible user’s password, use: 
        ansible   ALL=(ALL) ALL
      • To grant permissions to the ansible user to run all commands as any user and group on this host without entering the ansible user’s password, use: 
        ansible   ALL=(ALL) NOPASSWD: ALL

    Alternatively, configure a more fine-granular policy that matches your security requirements. For further details on sudoers policies, see the sudoers(5) manual page.

Results

  1. Verify that you can run commands from the control node on an all managed nodes: 
    [ansible@control-node]$ ansible all -m ping
     
    BECOME password: <password>
managed-node-01.example.com | SUCCESS => {
    	...
    	"ping": "pong"
}
...

    The hard-coded all group dynamically contains all hosts listed in the inventory file.

  2. Verify that privilege escalation works correctly by running the whoami utility on a managed host by using the Ansible command module: 
    [ansible@control-node]$ ansible managed-node-01.example.com -m command -a whoami
     
    BECOME password: <password>
managed-node-01.example.com | CHANGED | rc=0 >>
root

    If the command returns root, you configured sudo on the managed nodes correctly.