5.6. Changing an IdM service vault secret when compromised using Ansible

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Open your inventory file and make sure that the hosts onto which you want to retrieve the secret are defined correctly in the webservers section. For example, to instruct Ansible to retrieve the secret to webserver1.idm.example.com and webserver2.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com
   
   [webservers]
   webserver1.idm.example.com
   webserver2.idm.example.com

   重要

   Make sure that the list does not contain the compromised webserver, in the current example webserver3.idm.example.com.

3. Make a copy of the data-archive-in-asymmetric-vault.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/vault/data-archive-in-asymmetric-vault.yml data-archive-in-asymmetric-vault-copy.yml

4. Open the data-archive-in-asymmetric-vault-copy.yml file for editing.

5. Modify the file by setting the following variables in the freeipa.ansible_freeipa.ipavault task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to the name of the vault, for example secret_vault.
   • Set the service variable to the service owner of the vault, for example HTTP/webserver.idm.example.com.
   • Set the in variable to "{{ lookup('file', 'new-private-key-to-an-externally-signed-certificate.pem') | b64encode }}". This ensures that Ansible retrieves the file with the private key from the working directory on the Ansible controller rather than from the IdM server.

   • Set the action variable to member.

     This the modified Ansible playbook file for the current example:

   ---
   - name: Tests
     hosts: ipaserver
     gather_facts: false
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - freeipa.ansible_freeipa.ipavault:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: secret_vault
         service: HTTP/webserver.idm.example.com
         in: "{{ lookup('file', 'new-private-key-to-an-externally-signed-certificate.pem') | b64encode }}"
         action: member

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file data-archive-in-asymmetric-vault-copy.yml

8. Open the retrieve-data-asymmetric-vault-copy.yml file for editing.

9. Modify the file by setting the following variables in the freeipa.ansible_freeipa.ipavault task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to the name of the vault, for example secret_vault.
   • Set the service variable to the service owner of the vault, for example HTTP/webserver1.idm.example.com.
   • Set the private_key_file variable to the location of the private key used to retrieve the service vault secret.
   • Set the out variable to the location on the IdM server where you want to retrieve the new-private-key-to-an-externally-signed-certificate.pem secret, for example the current working directory.

   • Set the action variable to member.

     This the modified Ansible playbook file for the current example:

   ---
   - name: Retrieve data from vault
     hosts: ipaserver
     become: no
     gather_facts: false
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Retrieve data from the service vault
       freeipa.ansible_freeipa.ipavault:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: secret_vault
         service: HTTP/webserver1.idm.example.com
         vault_type: asymmetric
         private_key: "{{ lookup('file', 'service-private.pem') | b64encode }}"
         out: new-private-key-to-an-externally-signed-certificate.pem
         state: retrieved

10. Add a section to the playbook that retrieves the data file from the IdM server to the Ansible controller:

    ---
    - name: Retrieve data from vault
      hosts: ipaserver
      become: true
      gather_facts: false
      tasks:
    [...]
      - name: Retrieve data file
        fetch:
          src: new-private-key-to-an-externally-signed-certificate.pem
          dest: ./
          flat: true
          mode: 0600

11. Add a section to the playbook that transfers the retrieved new-private-key-to-an-externally-signed-certificate.pem file from the Ansible controller on to the webservers listed in the webservers section of the inventory file:

    ---
    - name: Send data file to webservers
      become: true
      gather_facts: no
      hosts: webservers
      tasks:
      - name: Send data to webservers
        copy:
          src: new-private-key-to-an-externally-signed-certificate.pem
          dest: /etc/pki/tls/private/httpd.key
          mode: 0444

12. Save the file.

13. Run the playbook:

    $ ansible-playbook --vault-password-file=password_file -v -i inventory.file retrieve-data-asymmetric-vault-copy.yml