Ansible for Configuration Management and IT automation

Wow, Ansible is a great tool for configuration management and IT automation. I got this reference from here and here.

1. Install ansible on your workstation (machine which will be the controller)
$ sudo yum install ansible
$ ansible --version

2. Create env variable
$ export ANSIBLE_HOSTS=~/ansible/ansible_hosts

3. Create hosts file
$ echo -e "perf-c690\nperf-c691" > ~/ansible/ansible_hosts

4. Do a quick ping
$ ansible all -m ping --ask-pass

5. Now, let's create ssh keys
(Should typically run using your own user account, have used root here for convenience) 
# ssh-keygen -t rsa

6. Copy public key to the remote machines
$ ansible all -m copy -a "src=/root/.ssh/id_rsa.pub dest=/tmp/id_rsa.pub" --ask-pass -c paramiko

Warning: error message: "Aborting, target uses selinux but python bindings (libselinux-python) aren't installed!"
Which means we need to install libselinux-python on the remote machine prior to copying the files there. We can use ansible to do that for us.

Install libselinux-python on remote machines
$ ansible all -m yum -a "name=libselinux-python state=latest" -u root --ask-pass -c paramiko

Now we can go back to copying the public key

7. Let's add the public key to the remote machines
$ ansible all -m shell -a "cat /tmp/id_rsa.pub >> /root/.ssh/authorized_keys" --ask-pass -c paramiko

8. Test if we actually don't need any password
$ ansible all -m shell -a "hostname"

9. Now we can do or install whatever on the remote machines, let's try installing expect
$ ansible all -m yum -a "name=expect state=latest" -u root

10. We can remotely reboot all machines at once
$ ansible all -a "/sbin/reboot" -u root

SSH Issue While Deploying Rails App Via Capistrano

Learned some lessons today about SSH and how to troubleshoot. While setting up Capistrano to deploy for the first time, I was getting this error message:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

As it turned out, SSH is very picky when it comes to permissions. The solution is to set proper permissions for ssh authorized_keys file. Symptom is this error message from /var/log/secure

Authentication refused: bad ownership or modes for file /home/samdc/.ssh/authorized_keys

Which means, its a file permission issue as noted in this post.

Following that...

$ chmod g-w /home/samdc
$ chmod 700 /home/samdc/.ssh
$ chmod 600 /home/samdc/.ssh/authorized_keys

One thing to note is that when accessing that location using a different account, we have to make sure to copy the public key of that different account to the same authorized_keys file.