2

I recently rented a Linux box and I intend to provision it using Ansible. I'd like to use Ansible as early as possible in the process. At this stage I only have a root account and the corresponding password.

Questions

  • Given the fact that my target box as well as OpenSSH-Server is running, would it be possible to copy my public key to the server and configure it with Ansible at this early stage?
  • Do I have to manually copy the pub key to the server and configure ssh for Ansible to be able to communicate with the server in the first place?

EDIT 1:

I should've mentioned, that after reading the docs I used the following syntax:

ansible <nameoftargetbox> -m ping -u root -k

The command basically means use user root ( -u ) and ask for password ( -k ). I am correctly prompted for the password, but I keep getting this response:

 <nameoftargetbox>| FAILED => to use -c ssh with passwords, you must install the sshpass program

Needless to say that a common ssh root@<targetbox> works flawlessly.

After researching some more I found a solution in the Ansible github issue tracker. I'll post it as an answer to this question.

2

Appending -c paramiko to ansible <nameoftargetbox> -m ping -u root -k forces Ansible to use the Paramiko Python library internally which appearently does not have to have sshpass installed. Please consult this closed issue on the Ansible github issue tracker.

EDIT1:

To answer the original question, yes it is possible to administer a Linux box using Ansible with the root account and the password. One could use the -c paramiko switch in the first place to copy the pubkey to the target and doing some more bootstrapping before switching to using full blown Ansible Playbooks.

2

It's very easy to use Ansible with a fresh Ubuntu machine. I'll assume you are on an Ubuntu box, your user on the remote machine is ubuntu, and your remote machine is REMOTE.COM (you can use an IP address as well). Take these steps:

  1. Copy your public ssh key to the remote machine so that you don't need to type your password to login.

    ssh-copy-id ubuntu@REMOTE.COM
    

    If you don't have an SSH key, use ssh-keygen and follow the prompts.

  2. SSH into the remote server (you should not need to type your password);

    ssh ubuntu@REMOTE.COM
    
  3. Setup your ubuntu user to be able to sudo without password (you'll need your password for this):

    sudo sh -c 'echo "ubuntu ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers.d/ubuntu'
    
  4. Ensure that python and python-apt are installed on the box:

    sudo apt-get install python python-apt
    
  5. Back to your local machine

    exit
    
  6. Setup your ANSIBLE_HOSTS file (say remote.hosts) with:

    [www]
    REMOTE.COM ansible_ssh_user=ubuntu
    

You're done. Now you can run your playbook with:

ANSIBLE_HOSTS=`pwd`/remote.hosts ansible-playbook -v site.yml
1

Based on these bullets from the official documents I would say you should be able to do what you want using just ssh without issue.

  • Dead simple setup
  • Super fast & parallel by default
  • No server or client daemons; use existing SSHd
  • No additional software required on client boxes
  • Modules can be written in ANY language
  • Awesome API for creating very powerful distributed scripts
  • Be usable as non-root
  • The easiest config management system to use, ever.

This is also echoed in the user's manual and documentation.

By default, Ansible 1.3 and later will try to use native OpenSSH for remote communication when possible. This enables both ControlPersist (a performance feature), Kerberos, and options in ~/.ssh/config such as Jump Host setup. When using Enterprise Linux 6 operating systems as the control machine (Red Hat Enterprise Linux and derivatives such as CentOS), however, the version of OpenSSH may be too old to support Control Persist. On these operating systems, Ansible will fallback into using a high-quality python implementation of OpenSSH called ‘paramiko’. If you wish to use features like Kerberized SSH and more, consider using Fedora, OS X, or Ubuntu as your control machine until a newer version of OpenSSH is available for your platform – or engage ‘accelerated mode’ in Ansible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.