One place for hosting & domains

      Automating Initial Server Setup with Ansible on Ubuntu 18.04


      Introduction

      When you first create a new Ubuntu 18.04 server, there are a few configuration steps that you should take early on as part of the basic setup. This will increase the security and usability of your server, working as a solid foundation for subsequent actions.

      While you can complete these steps manually, automating the process will save you time and eliminate human error. With the popularization of containerized applications and microservices, server automation now plays an essential role in systems administration. It is also a way to establish standard procedures for new servers.

      This guide explains how to use Ansible to automate the steps contained in our Initial Server Setup Guide. Ansible is a modern configuration management tool that can be used to automate the provisioning and configuration of remote systems.

      Pre-Flight Check

      In order to execute the automated setup provided by the playbook we’re discussing in this guide, you’ll need:

      • Ansible installed either on your local machine or on a remote server that you have set up as an Ansible Control Node. You can follow Step 1 of the tutorial How to Install and Configure Ansible on Ubuntu 18.04 to get this set up.
      • Root access to one or more Ubuntu 18.04 servers that will be managed by Ansible.

      Before running a playbook, it’s important to make sure Ansible is able to connect to your servers via SSH and run Ansible modules using Python. The next two sections cover how to set up your Ansible inventory to include your servers and how to run ad-hoc Ansible commands to test for connectivity and valid credentials.

      Inventory File

      The inventory file contains information about the hosts you’ll manage with Ansible. You can include anywhere from one to several hundred of servers in your inventory file, and hosts can be organized into groups and subgroups. The inventory file is also often used to set variables that will be valid for certain hosts and groups only, in order to be used within playbooks and templates. Some variables can also affect the way a playbook is run, like the ansible_python_interpreter variable that we’ll see in a moment.

      To inspect the contents of your default Ansible inventory, open the /etc/ansible/hosts file using your command-line editor of choice, on your local machine or an Ansible Control Node:

      • sudo nano /etc/ansible/hosts

      Note: some Ansible installations won’t create a default inventory file. If the file doesn’t exist in your system, you can create a new file at /etc/ansible/hosts or provide a custom inventory path using the -i parameter when running commands and playbooks.

      The default inventory file provided by the Ansible installation contains a number of examples that you can use as references for setting up your inventory. The following example defines a group named servers with three different servers in it, each identified by a custom alias: server1, server2, and server3:

      /etc/ansible/hosts

      [servers]
      server1 ansible_host=203.0.113.111
      server2 ansible_host=203.0.113.112
      server3 ansible_host=203.0.113.113
      
      [servers:vars]
      ansible_python_interpreter=/usr/bin/python3
      

      The server:vars subgroup sets the ansible_python_interpreter host parameter that will be valid for all hosts included in the servers group. This parameter makes sure the remote server uses the /usr/bin/python3 Python 3 executable instead of /usr/bin/python (Python 2.7), which is not present on recent Ubuntu versions.

      To finish setting up your inventory file, replace the highlighted IPs with the IP addresses of your servers. When you’re finished, save and close the file by pressing CTRL+X then y to confirm changes and then ENTER.

      Now that your inventory file is ready, it’s time to test connectivity to your nodes

      Testing Connectivity

      After setting up the inventory file to include your servers, it’s time to check if Ansible is able to connect to these servers and run commands via SSH. For this guide, we will be using the Ubuntu root account because that’s typically the only account available by default on newly created servers. This playbook will create a new non-root user with sudo privileges that you should use in subsequent interactions with the remote server.

      From your local machine or Ansible Control Node, run:

      • ansible -m ping all -u root

      This command will use the built-in ping Ansible module to run a connectivity test on all nodes from your default inventory, connecting as root. The ping module will test:
      if hosts are accessible;
      if you have valid SSH credentials;
      if hosts are able to run Ansible modules using Python.

      If instead of key-based authentication you’re using password-based authentication to connect to remote servers, you should provide the additional parameter -k to the Ansible command, so that it will prompt you for the password of the connecting user.

      • ansible -m ping all -u root -k

      Note: Keep in mind that some servers might have additional security measures against password-based authentication as the root user, and in some cases you might be required to manually log in to the server to change the initial root password.

      You should get output similar to this:

      Output

      server1 | SUCCESS => { "changed": false, "ping": "pong" } server2 | SUCCESS => { "changed": false, "ping": "pong" } server3 | SUCCESS => { "changed": false, "ping": "pong" }

      If this is the first time you’re connecting to these servers via SSH, you’ll be asked to confirm the authenticity of the hosts you’re connecting to via Ansible. When prompted, type yes and then hit Enter to confirm.

      Once you get a “pong” reply back from a host, it means you’re ready to run Ansible commands and playbooks on that server.

      What Does this Playbook Do?

      This Ansible playbook provides an alternative to manually running through the procedure outlined in the Ubuntu 18.04 initial server setup guide and the guide on setting up SSH keys on Ubuntu 18.04.

      Running this playbook will cause the following actions to be performed:

      1. The administrative group wheels is created and then configured for passwordless sudo.
      2. A new administrative user is created within that group, using the name specified by the create_user variable.
      3. A public SSH key is copied from the location defined by the variable copy_local_key, and added to the authorized_keys file for the user created in the previous step.
      4. Password-based authentication is disabled for the root user.
      5. The local apt package index is updated and basic packages defined by the variable sys_packages are installed.
      6. The UFW firewall is configured to allow only SSH connections and deny any other requests.

      For more information about each of the steps included in this playbook, please refer to our Ubuntu 18.04 initial server setup guide.

      Once the playbook has finished running, you’ll be able to log in to the server using the newly created sudo account.

      How to Use this Playbook

      To get started, we’ll download the contents of the playbook to your Ansible Control Node. This can be either your local machine, or a remote server where you have Ansible installed and your inventory set up.

      For your convenience, the contents of the playbook are also included in a further section of this guide.

      To download this playbook from the command-line, you can use curl:

      • curl -L https://raw.githubusercontent.com/do-community/ansible-playbooks/master/initial_server_setup/ubuntu1804.yml -o initial_server_setup.yml

      This will download the contents of the playbook to a file named initial_server_setup.yml on your current local path. You can examine the contents of the playbook by opening the file with your command-line editor of choice:

      • sudo nano initial_server_setup.yml

      Once you’ve opened the playbook file, you should notice a section named vars with three distinct variables that require your attention:

      • create_user: The name of the non-root user account to create and grant sudo privileges to. Our example uses sammy, but you can use whichever username you’d like.
      • copy_local_key: Local path to a valid SSH public key to set up as an authorized key for the new non-root sudo account. The default value points to the current local user’s public key located at ~/.ssh/id_rsa.pub.
      • sys_packages: A list of basic system packages that will be installed using the package manager tool apt.

      Once you’re done updating the variables inside initial_server_setup.yml, save and close the file.

      You’re now ready to run this playbook on one or more servers. Most playbooks are configured to be executed on all servers from your inventory, by default. We can use the -l flag to make sure that only a subset of servers, or a single server, is affected by the playbook. To execute the playbook only on server1, you can use the following command:

      • ansible-playbook initial_server_setup.yml -l server1

      You will get output similar to this:

      Output

      PLAY [all] *************************************************************************************************************************************** TASK [Make sure we have a 'wheel' group] ********************************************************************************************************* changed: [server1] TASK [Allow 'wheel' group to have passwordless sudo] ********************************************************************************************* changed: [server1] TASK [Create a new regular user with sudo privileges] ******************************************************************************************** changed: [server1] TASK [Set authorized key for remote user] ******************************************************************************************************** changed: [server1] TASK [Disable password authentication for root] ************************************************************************************************** changed: [server1] TASK [Update apt] ******************************************************************************************************************************** changed: [server1] TASK [Install required system packages] ********************************************************************************************************** ok: [server1] TASK [UFW - Allow SSH connections] *************************************************************************************************************** changed: [server1] TASK [UFW - Deny all other incoming traffic by default] ****************************************************************************************** changed: [server1] PLAY RECAP *************************************************************************************************************************************** server1 : ok=9 changed=8 unreachable=0 failed=0

      Once the playbook execution is finished, you’ll be able to log in to the server with:

      • ssh sammy@server_domain_or_IP

      Remember to replace sammy with the user defined by the create_user variable, and server_domain_or_IP with your server’s hostname or IP address.

      In case you have set a custom public key with the copy_local_key variable, you’ll need to provide an extra parameter specifying the location of its private key counterpart:

      • ssh sammy@server_domain_or_IP -i ~/.ssh/ansible_controller_key

      After logging in to the server, you can check the UFW firewall’s active rules to confirm that it’s properly configured:

      You should get output similar to this:

      Output

      Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6)

      This means that the UFW firewall has successfully been enabled. Since this was the last task in the playbook, it confirms that the playbook was fully executed on this server.

      The Playbook Contents

      You can find the initial server setup playbook in the ansible-playbooks repository in the DigitalOcean Community GitHub organization. To copy or download the script contents directly, click the Raw button towards the top of the script, or click here to view the raw contents directly.

      The full contents are also included here for convenience:

      initial_server_setup.yml

      ---
      - hosts: all
        remote_user: root
        gather_facts: false
        vars:
          create_user: sammy
          copy_local_key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
          sys_packages: [ 'curl', 'vim', 'git', 'ufw' ]
      
        tasks:
          - name: Make sure we have a 'wheel' group
            group:
              name: wheel
              state: present
      
          - name: Allow 'wheel' group to have passwordless sudo
            lineinfile:
              path: /etc/sudoers
              state: present
              regexp: '^%wheel'
              line: '%wheel ALL=(ALL) NOPASSWD: ALL'
              validate: '/usr/sbin/visudo -cf %s'
      
          - name: Create a new regular user with sudo privileges
            user:
              name: "{{ create_user }}"
              groups: wheel
              shell: /bin/bash
      
          - name: Set authorized key for remote user
            authorized_key:
              user: "{{ create_user }}"
              state: present
              key: "{{ copy_local_key }}"
      
          - name: Disable password authentication for root
            lineinfile:
              path: /etc/ssh/sshd_config
              state: present
              regexp: '^PermitRootLogin'
              line: 'PermitRootLogin prohibit-password'
      
          - name: Update apt
            apt: update_cache=yes
      
          - name: Install required system packages
            apt: name={{ sys_packages }} state=latest
      
          - name: UFW - Allow SSH connections
            ufw:
              rule: allow
              name: OpenSSH
      
          - name: UFW - Deny all other incoming traffic by default
            ufw:
              state: enabled
              policy: deny
              direction: incoming
      
      

      Feel free to modify this playbook or include new tasks to best suit your individual needs within your own workflow.

      Conclusion

      Automating the initial server setup can save you time, while also making sure your servers will follow a standard configuration that can be improved and customized to your needs. With the distributed nature of modern applications and the need for more consistency between different staging environments, automation like this becomes a necessity.

      In this guide, we demonstrated how to use Ansible for automating the initial tasks that should be executed on a fresh server, such as creating a non-root user with sudo access, enabling UFW and disabling remote root login.

      If you'd like to include new tasks in this playbook to further customize your initial server setup, please refer to our introductory Ansible guide Configuration Management 101: Writing Ansible Playbooks.



      Source link

      Getting Started with Puppet – Basic Installation and Setup


      Updated by Linode Written by Linode

      Puppet is a configuration management tool that simplifies system administration. Puppet uses a client/server model in which your managed nodes, running a process called the Puppet agent, talk to and pull down configuration profiles from a Puppet master.

      Puppet deployments can range from small groups of servers up to enterprise-level operations. This guide will demonstrate how to install Puppet 6.1 on three servers:

      • A Puppet master running Ubuntu 18.04
      • A managed Puppet node running Ubuntu 18.04
      • A managed Puppet node running CentOS 7

      After installation, the next section will show you how to secure these servers via Puppet. This section will demonstrate core features of the Puppet language.

      Note

      Most guides will instruct you to follow the How to Secure your Server guide before proceeding. Because Puppet will be used to perform this task, you should begin this guide as the root user. A limited user with administrative privileges will be configured via Puppet in later steps.

      Before You Begin

      The following table displays example system information for the servers that will be deployed in this guide:

      Description OS Hostname FQDN IP
      Puppet master Ubuntu 18.04 puppet puppet.example.com 192.0.2.2
      Node 1 (Ubuntu) Ubuntu 18.04 puppet-agent-ubuntu puppet-agent-ubuntu.example.com 192.0.2.3
      Node 2 (CentOS) CentOS 7 puppet-agent-centos puppet-agent-centos.example.com 192.0.2.4

      You can choose different hostnames and fully qualified domain names (FQDN) for each of your servers, and the IP addresses for your servers will be different from the example addresses listed. You will need to have a registered domain name in order to specify FQDNs for your servers.

      Throughout this guide, commands and code snippets will reference the values displayed in this table. Wherever such a value appears, replace it with your own value.

      Create your Linodes

      1. Create three Linodes corresponding to the servers listed in the table above. Your Puppet master Linode should have at least four CPU cores; the Linode 8GB plan is recommended. The two other nodes can be of any plan size, depending on how you intend to use them after Puppet is installed and configured.

      2. Configure your timezone on your master and agent nodes so that they all have the same time data.

      3. Set the hostname for each server.

      4. Set the FQDN for each Linode by editing the servers’ /etc/hosts files.

        Example content for the hosts file

        You can model the contents of your /etc/hosts files on these snippets:

        Master
        1
        2
        3
        4
        5
        6
        7
        
        127.0.0.1   localhost
        192.0.2.2   puppet.example.com puppet
        
        # The following lines are desirable for IPv6 capable hosts
        ::1     localhost ip6-localhost ip6-loopback
        ff02::1 ip6-allnodes
        ff02::2 ip6-allrouters
        Node 1 (Ubuntu)
        1
        2
        3
        4
        5
        6
        7
        
        127.0.0.1   localhost
        192.0.2.3   puppet-agent-ubuntu.example.com puppet-agent-ubuntu
        
        # The following lines are desirable for IPv6 capable hosts
        ::1     localhost ip6-localhost ip6-loopback
        ff02::1 ip6-allnodes
        ff02::2 ip6-allrouters
        Node 2 (CentOS)
        1
        2
        3
        
        127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
        ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
        192.0.2.4   puppet-agent-centos.example.com puppet-agent-centos
      5. Set up DNS records for your Linodes’ FQDNs. For each Linode, create a new A record with the name specified by its FQDN and assign it to that Linode’s IP address.

        If you don’t use Linode’s name servers for your domain, consult your name server authority’s website for instructions on how to edit your DNS records.

        Updating DNS records at common nameserver authorities

        The following support documents describe how to update DNS records at common nameserver authorities:

      Puppet Master

      Install the Puppet Server Software

      The Puppet master runs the puppetserver service, which is responsible for compiling and supplying configuration profiles to your managed nodes.

      The puppetserver service has the Puppet agent service as a dependency (which is just called puppet when running on your system). This means that the agent software will also be installed and can be run on your master. Because your master can run the agent service, you can configure your master via Puppet just as you can configure your other managed nodes.

      1. Log in to your Puppet master via SSH (as root):

        ssh root@puppet.example.com
        
      2. Download the Puppet repository, update your system packages, and install puppetserver:

        wget https://apt.puppetlabs.com/puppet-release-bionic.deb
        dpkg -i puppet-release-bionic.deb
        apt update
        apt install puppetserver
        

      Configure the Server Software

      1. Use the puppet config command to set values for the dns_alt_names setting:

        /opt/puppetlabs/bin/puppet config set dns_alt_names 'puppet,puppet.example.com' --section main
        

        If you inspect the configuration file, you’ll see that the setting has been added:

        cat /etc/puppetlabs/puppet/puppet.conf
        
          
        [main]
        dns_alt_names = puppet,puppet.example.com
        # ...
        
        

        Note

        The puppet command by default is not added to your PATH. Using Puppet’s interactive commands requires a full file path. To avoid this, update your PATH for your existing shell session:

        export PATH=/opt/puppetlabs/bin:$PATH
        

        A more permanent solution would be to add this to your .profile or .bashrc files.

      2. Update your Puppet master’s /etc/hosts to resolve your managed nodes’ IP addresses. For example, your /etc/hosts file might look like the following:

        /etc/hosts
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        
        127.0.0.1   localhost
        192.0.2.2   puppet.example.com puppet
        
        192.0.2.3   puppet-agent-ubuntu.example.com puppet-agent-ubuntu
        192.0.2.4   puppet-agent-centos.example.com puppet-agent-centos
        
        # The following lines are desirable for IPv6 capable hosts
        ::1     localhost ip6-localhost ip6-loopback
        ff02::1 ip6-allnodes
        ff02::2 ip6-allrouters

        Note

      3. Start and enable the puppetserver service:

        systemctl start puppetserver
        systemctl enable puppetserver
        

        By default, the Puppet master listens for client connections on port 8140. If the puppetserver service fails to start, check that the port is not already in use:

        netstat -anpl | grep 8140
        

      Puppet Agents

      Install Puppet Agent

      1. On your managed node running Ubuntu 18.04, install the puppet-agent package:

        wget https://apt.puppetlabs.com/puppet-release-bionic.deb
        dpkg -i puppet-release-bionic.deb
        apt update
        apt install puppet-agent
        
      2. On your managed node running CentOS 7, enter:

        rpm -Uvh https://yum.puppet.com/puppet/puppet-release-el-7.noarch.rpm
        yum install puppet-agent
        

      Configure Puppet Agent

      1. Modify your managed nodes’ hosts files to resolve the Puppet master’s IP. To do so, add a line like:

        /etc/hosts
        1
        
        192.0.2.2    puppet.example.com puppet

        Example content for the hosts file

        You can model the contents of your managed nodes’ /etc/hosts files on the following snippets. These incorporate the FQDN declarations described in the Create your Linodes section:

        Node 1 (Ubuntu)
        1
        2
        3
        4
        5
        6
        7
        8
        9
        
        127.0.0.1   localhost
        192.0.2.3   puppet-agent-ubuntu.example.com puppet-agent-ubuntu
        
        192.0.2.2   puppet.example.com puppet
        
        # The following lines are desirable for IPv6 capable hosts
        ::1     localhost ip6-localhost ip6-loopback
        ff02::1 ip6-allnodes
        ff02::2 ip6-allrouters
        Node 2 (CentOS)
        1
        2
        3
        4
        5
        
        127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
        ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
        192.0.2.4   puppet-agent-centos.example.com puppet-agent-centos
        
        192.0.2.2   puppet.example.com puppet
      2. On each managed node, use the puppet config command to set the value for your server setting to the FQDN of the master:

        /opt/puppetlabs/bin/puppet config set server 'puppet.example.com' --section main
        

        If you inspect the configuration file on the nodes, you’ll see that the setting has been added:

        cat /etc/puppetlabs/puppet/puppet.conf
        
          
        [main]
        server = puppet.example.com
        # ...
        
        
      3. Use the puppet resource command to start and enable the Puppet agent service:

        /opt/puppetlabs/bin/puppet resource service puppet ensure=running enable=true
        

        Note

        On systemd systems, the above command is equivalent to using these two systemctl commands:

        systemctl start puppet
        systemctl enable puppet
        

      Generate and Sign Certificates

      Before your managed nodes can receive configurations from the master, they first need to be authenticated:

      1. On your Puppet agents, generate a certificate for the Puppet master to sign:

        /opt/puppetlabs/bin/puppet agent -t
        

        This command will output an error, stating that no certificate has been found. This error is because the generated certificate needs to be approved by the Puppet master.

      2. Log in to your Puppet master and list the certificates that need approval:

        /opt/puppetlabs/bin/puppetserver ca list
        

        It should output a list with your agent nodes’ hostnames.

      3. Approve the certificates:

        /opt/puppetlabs/bin/puppetserver ca sign --certname puppet-agent-ubuntu.example.com,puppet-agent-centos.example.com
        
      4. Return to the Puppet agent nodes and run the Puppet agent again:

        /opt/puppetlabs/bin/puppet agent -t
        

        You should see something like the following:

          
        Info: Downloaded certificate for hostname.example.com from puppet
        Info: Using configured environment 'production'
        Info: Retrieving pluginfacts
        Info: Retrieving plugin
        Info: Retrieving locales
        Info: Caching catalog for hostname.example.com
        Info: Applying configuration version '1547066428'
        Info: Creating state file /opt/puppetlabs/puppet/cache/state/state.yaml
        Notice: Applied catalog in 0.02 seconds
        
        

      Add Modules to Configure Agent Nodes

      The Puppet master and agent nodes are now functional, but they are not secure. Based on concepts from the How to Secure your Server guide, a limited user and a firewall should be configured. This can be done on all nodes through the creation of basic Puppet modules, shown below.

      Note

      This is not meant to provide a basis for a fully-hardened server, and is intended only as a starting point. Alter and add firewall rules and other configuration options, depending on your specific needs.

      Puppet modules are Puppet’s prescribed way of organizing configuration code to serve specific purposes, like installing and configuration an application. You can create custom modules, or you can download and use modules published on Puppet Forge.

      Add a Limited User

      To create a new limited user on your nodes, you will create and apply a new module called accounts. This module will employ the user resource.

      1. From the Puppet master, navigate to the /etc/puppetlabs/code/environments/production/modules directory. When a managed node requests its configuration from the master, the Puppet server process will look in this location for your modules:

        cd /etc/puppetlabs/code/environments/production/modules/
        
      2. Create the directory for a new accounts module:

        mkdir accounts
        cd accounts
        
      3. Create the following directories inside the accounts module:

        mkdir {examples,files,manifests,templates}
        
        Directory Description
        manifests The Puppet code which powers the module
        files Static files to be copied to managed nodes
        templates Template files to be copied to managed nodes that can e customized with variables
        examples Example code which shows how to use the module

        Note

        Review Puppet’s Module fundamentals article for more information on how a module is structured.
      4. Navigate to the manifests directory:

        cd manifests
        
      5. Any file which contains Puppet code is called a manifest, and each manifest file ends in .pp. When located inside a module, a manifest should only define one class. If a module’s manifests directory has an init.pp file, the class definition it contains is considered the main class for the module. The class definition inside init.pp should have the same name as the module.

        Create an init.pp file with the contents of the following snippet. Replace all instances of username with a username of your choosing:

        accounts/manifests/init.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        
        class accounts {
        
          user { 'username':
            ensure      => present,
            home        => '/home/username',
            shell       => '/bin/bash',
            managehome  => true,
            gid         => 'username',
          }
        
        }
        Option Description
        ensure Ensures that the user exists if set to present, or does not exist if set to absent
        home The path for the user’s home directory
        managehome Controls whether a home directory should be created when creating the user
        shell The path to the shell for the user
        gid The user’s primary group
      6. Although the class declares what the user’s primary group should be, it will not create the group itself. Create a new file called groups.pp inside the manifests directory with the following contents. Replace username with your chosen username:

        accounts/manifests/groups.pp
        1
        2
        3
        4
        5
        6
        7
        
        class accounts::groups {
        
          group { 'username':
            ensure  => present,
          }
        
        }
      7. Your accounts class can declare your new accounts::groups class for use within the accounts class scope. Open your init.pp in your editor and enter a new include declaration at the beginning of the class:

        accounts/manifests/init.pp
        1
        2
        3
        4
        5
        6
        7
        
        class accounts {
        
          include accounts::groups
        
          # ...
        
        }
      8. The new user should have administrative privileges. Because we have agent nodes on both Debian- and Red Hat-based systems, the new user needs to be in the sudo group on Debian systems, and the wheel group on Red Hat systems.

        This value can be set dynamically through the use of Puppet facts. The facts system collects system information about your nodes and makes it available in your manifests.

        Add a selector statement to the top of your accounts class:

        accounts/manifests/init.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        
        class accounts {
        
          $rootgroup = $osfamily ? {
            'Debian'  => 'sudo',
            'RedHat'  => 'wheel',
            default   => warning('This distribution is not supported by the Accounts module'),
          }
        
          include accounts::groups
        
          # ...
        
        }

        This code defines the value for the $rootgroup variable by checking the value of $osfamily, which is one of Puppet’s core facts. If the value for $osfamily does not match Debian or Red Hat, the default value will output a warning that the distribution selected is not supported by this module.

        Note

        The Puppet Configuration Language executes code from top to bottom. Because the user resource declaration will reference the $rootgroup variable, you must define $rootgroup before the user declaration.

      9. Update the user resource to include the groups option as follows:

        accounts/manifests/init.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        
        # ...
        
        user { 'username':
          ensure      => present,
          home        => '/home/username',
          shell       => '/bin/bash',
          managehome  => true,
          gid         => 'username',
          groups      => "$rootgroup",
        }
        
        # ...

        The value "$rootgroup" is enclosed in double quotes " " instead of single quotes ' ' because it is a variable which needs to be interpolated in your code.

      10. The final value that needs to be added is the user’s password. Since we do not want to use plain text, the password should be supplied to Puppet as a SHA1 digest, which is supported by default. Generate a digest with the openssl command:

        openssl passwd -1
        

        You will be prompted to enter your password. A hashed password will be output. Copy this value to your clipboard.

      11. Update the user resource to include the password option as follows; insert your copied password hash as the value for the option:

        accounts/manifests/init.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        
        # ...
        
        user { 'username':
          ensure      => present,
          home        => '/home/username',
          shell       => '/bin/bash',
          managehome  => true,
          gid         => 'username',
          groups      => "$rootgroup",
          password    => 'your_password_hash',
        }
        
        # ...

        Caution

        The hashed password must be included in single quotes ' '.

      12. After saving your changes, use the Puppet parser to ensure that the code is correct:

        /opt/puppetlabs/bin/puppet parser validate init.pp
        

        Any errors that need to be addressed will be logged to standard output. If nothing is returned, your code is valid.

      13. Navigate to the examples directory and create another init.pp file:

        cd ../examples
        
        accounts/examples/init.pp
      14. While still in the examples directory, test the module:

        /opt/puppetlabs/bin/puppet apply --noop init.pp
        

        Note

        The --noop parameter prevents Puppet from actually applying the module to your system and making any changes.

        It should return:

          
        Notice: Compiled catalog for puppet.example.com in environment production in 0.26 seconds
        Notice: /Stage[main]/Accounts::Groups/Group[username]/ensure: current_value absent, should be present (noop)
        Notice: Class[Accounts::Groups]: Would have triggered 'refresh' from 1 events
        Notice: /Stage[main]/Accounts/User[username]/ensure: current_value absent, should be present (noop)
        Notice: Class[Accounts]: Would have triggered 'refresh' from 1 events
        Notice: Stage[main]: Would have triggered 'refresh' from 2 events
        Notice: Finished catalog run in 0.02 seconds
        
        
      15. Again from the examples directory, run puppet apply to make these changes to the Puppet master server:

        /opt/puppetlabs/bin/puppet apply init.pp
        

        Puppet will create your limited Linux user on your master.

      16. Log out as root and log in to the Puppet master as your new user.

      Edit SSH Settings

      Although a new limited user has successfully been added to the Puppet master, it is still possible to login to the system as root. To properly secure your system, root access should be disabled.

      Note

      Because you are now logged in to the Puppet master as a limited user, you will need to execute commands and edit files with the user’s sudo privileges.

      1. Navigate to the files directory within the accounts module:

        cd /etc/puppetlabs/code/environments/production/modules/accounts/files
        
      2. Copy your system’s existing sshd_config file to this directory:

        sudo cp /etc/ssh/sshd_config .
        
      3. Open the file in your editor (making sure that you open it with sudo privileges) and set the PermitRootLogin value to no:

        accounts/files/sshd_config
      4. Navigate back to the manifests directory:

        cd ../manifests
        
      5. Create a new manifest called ssh.pp. Use the file resource to replace the default SSH configuration file with one managed by Puppet:

        accounts/manifests/ssh.pp
        1
        2
        3
        4
        5
        6
        7
        8
        
        class accounts::ssh {
        
          file { '/etc/ssh/sshd_config':
            ensure  => present,
            source  => 'puppet:///modules/accounts/sshd_config',
          }
        
        }

        Note

        The files directory is omitted from the source line because the files folder is the default location of files within a module. For more information on the format used to access resources in a module, refer to the official Puppet module documentation.
      6. Create a second resource to restart the SSH service and set it to run whenever sshd_config is changed. This will also require a selector statement because the SSH service is named ssh on Debian systems and sshd on Red Hat systems:

        accounts/manifests/ssh.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        14
        15
        16
        17
        18
        19
        
        class accounts::ssh {
        
          $sshname = $osfamily ? {
            'Debian'  => 'ssh',
            'RedHat'  => 'sshd',
            default   => warning('This distribution is not supported by the Accounts module'),
          }
        
          file { '/etc/ssh/sshd_config':
            ensure  => present,
            source  => 'puppet:///modules/accounts/sshd_config',
            notify  => Service["$sshname"],
          }
        
          service { "$sshname":
            hasrestart  => true,
          }
        
        }

        Note

      7. Include the accounts::ssh class within the accounts class in init.pp:

        accounts/manifests/init.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        
        class accounts {
        
          # ...
        
          include accounts::groups
          include accounts::ssh
        
          # ...
        
        }

        The complete init.pp

        The contents of your init.pp should now look like the following snippet:

        accounts/manifests/init.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        14
        15
        16
        17
        18
        19
        20
        21
        22
        
        class accounts {
        
            $rootgroup = $osfamily ? {
                'Debian' => 'sudo',
                'RedHat' => 'wheel',
                default => warning('This distro not supported by Accounts module'),
            }
        
            include accounts::groups
            include accounts::ssh
        
            user { 'example':
                ensure  => present,
                home    => '/home/username',
                shell   => '/bin/bash',
                managehome  => true,
                gid     => 'username',
                groups  => "$rootgroup",
                password => 'your_password_hash'
            }
        
        }
      8. Run the Puppet parser to test the syntax of the new class, then navigate to the examples directory to test and run the update to your accounts class:

        sudo /opt/puppetlabs/bin/puppet parser validate ssh.pp
        cd ../examples
        sudo /opt/puppetlabs/bin/puppet apply --noop init.pp
        sudo /opt/puppetlabs/bin/puppet apply init.pp
        

        Note

        You may see the following line in your output when validating:

          
        Error: Removing mount "files": /etc/puppet/files does not exist or is not a directory
        
        

        This refers to a Puppet configuration file, not the module resource you’re trying to copy. If this is the only error in your output, the operation should still succeed.

      9. To ensure that the ssh class is working properly, log out of the Puppet master and then try to log in as root. You should not be able to do so.

      Add and Configure IPtables

      To complete this guide’s security settings, the firewall needs to be configure on your Puppet master and nodes. The iptables firewall software will be used.

      1. By default, changes to your iptables rules will not persist across reboots. To avoid this, install the appropriate package on your Puppet master and nodes:

        Ubuntu/Debian:

        sudo apt install iptables-persistent
        

        CentOS 7:

        CentOS 7 uses firewalld by default as a controller for iptables. Be sure firewalld is stopped and disabled before starting to work directly with iptables:

        sudo systemctl stop firewalld && sudo systemctl disable firewalld
        sudo yum install iptables-services
        
      2. On your Puppet master, install Puppet Lab’s firewall module from the Puppet Forge:

        sudo /opt/puppetlabs/bin/puppet module install puppetlabs-firewall
        

        The module will be installed in your /etc/puppetlabs/code/environments/production/modules directory.

      3. Navigate to the manifests directory inside the new firewall module:

        cd /etc/puppetlabs/code/environments/production/modules/firewall/manifests/
        
      4. Create a file titled pre.pp, which will contain all basic networking rules that should be run first:

        firewall/manifests/pre.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        14
        15
        16
        17
        18
        19
        20
        21
        22
        23
        24
        25
        26
        27
        28
        29
        30
        31
        32
        33
        34
        35
        36
        37
        38
        39
        40
        41
        42
        43
        44
        45
        46
        47
        48
        49
        50
        51
        52
        53
        54
        55
        
        class firewall::pre {
        
          Firewall {
            require => undef,
          }
        
           # Accept all loopback traffic
          firewall { '000 lo traffic':
            proto       => 'all',
            iniface     => 'lo',
            action      => 'accept',
          }->
        
           #Drop non-loopback traffic
          firewall { '001 reject non-lo':
            proto       => 'all',
            iniface     => '! lo',
            destination => '127.0.0.0/8',
            action      => 'reject',
          }->
        
           #Accept established inbound connections
          firewall { '002 accept established':
            proto       => 'all',
            state       => ['RELATED', 'ESTABLISHED'],
            action      => 'accept',
          }->
        
           #Allow all outbound traffic
          firewall { '003 allow outbound':
            chain       => 'OUTPUT',
            action      => 'accept',
          }->
        
           #Allow ICMP/ping
          firewall { '004 allow icmp':
            proto       => 'icmp',
            action      => 'accept',
          }
        
           #Allow SSH connections
          firewall { '005 Allow SSH':
            dport    => '22',
            proto   => 'tcp',
            action  => 'accept',
          }->
        
           #Allow HTTP/HTTPS connections
          firewall { '006 HTTP/HTTPS connections':
            dport    => ['80', '443'],
            proto   => 'tcp',
            action  => 'accept',
          }
        
        }
      5. In the same directory, create post.pp, which will run any firewall rules that need to be input last:

        firewall/manifests/post.pp
        1
        2
        3
        4
        5
        6
        7
        8
        9
        
        class firewall::post {
        
          firewall { '999 drop all':
            proto  => 'all',
            action => 'drop',
            before => undef,
          }
        
        }

        These rules will direct the system to drop all inbound traffic that is not already permitted in the firewall.

      6. Run the Puppet parser on both files to check their syntax for errors:

        sudo /opt/puppetlabs/bin/puppet parser validate pre.pp
        sudo /opt/puppetlabs/bin/puppet parser validate post.pp
        
      7. Navigate to the main manifests directory:

        cd /etc/puppetlabs/code/environments/production/manifests
        
      8. Create a file named site.pp inside /etc/puppetlabs/code/environments/production/manifests. This file is the main manifest for the Puppet server service. It is used to map modules, classes, and resources to the nodes that they should be applied to.

        site.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        14
        15
        16
        17
        18
        19
        20
        21
        22
        23
        24
        25
        26
        
        node default {
        
        }
        
        node 'puppet.example.com' {
        
          include accounts
        
          resources { 'firewall':
            purge => true,
          }
        
          Firewall {
            before        => Class['firewall::post'],
            require       => Class['firewall::pre'],
          }
        
          class { ['firewall::pre', 'firewall::post']: }
        
          firewall { '200 Allow Puppet Master':
            dport         => '8140',
            proto         => 'tcp',
            action        => 'accept',
          }
        
        }
      9. Run the site.pp file through the Puppet parser to check its syntax for errors. Then, test the file with the --noop option to see if it will run:

        sudo /opt/puppetlabs/bin/puppet parser validate site.pp
        sudo /opt/puppetlabs/bin/puppet apply --noop site.pp
        

        If successful, run puppet apply without the --noop option:

        sudo /opt/puppetlabs/bin/puppet apply site.pp
        
      10. Once Puppet has finished applying the changes, check the Puppet master’s iptables rules:

        sudo iptables -L
        

        It should return:

        Chain INPUT (policy ACCEPT)
        target     prot opt source               destination
        ACCEPT     all  --  anywhere             anywhere             /* 000 lo traffic */
        REJECT     all  --  anywhere             127.0.0.0/8          /* 001 reject non-lo */ reject-with icmp-port-unreachable
        ACCEPT     all  --  anywhere             anywhere             /* 002 accept established */ state RELATED,ESTABLISHED
        ACCEPT     icmp --  anywhere             anywhere             /* 004 allow icmp */
        ACCEPT     tcp  --  anywhere             anywhere             multiport ports ssh /* 005 Allow SSH */
        ACCEPT     tcp  --  anywhere             anywhere             multiport ports http,https /* 006 HTTP/HTTPS connections */
        ACCEPT     tcp  --  anywhere             anywhere             multiport ports 8140 /* 200 Allow Puppet Master */
        DROP       all  --  anywhere             anywhere             /* 999 drop all */
        
        Chain FORWARD (policy ACCEPT)
        target     prot opt source               destination
        
        Chain OUTPUT (policy ACCEPT)
        target     prot opt source               destination
        ACCEPT     tcp  --  anywhere             anywhere             /* 003 allow outbound */
        

      Apply Modules to the Agent Nodes

      Now that the accounts and firewall modules have been created, tested, and run on the Puppet master, it is time to apply them to your managed nodes.

      1. On the Puppet master, navigate to /etc/puppetlabs/code/environments/production/manifests:

        cd /etc/puppetlabs/code/environments/production/manifests
        
      2. Update site.pp to declare the modules, classes, and resources that should be applied to each managed node:

        site.pp
         1
         2
         3
         4
         5
         6
         7
         8
         9
        10
        11
        12
        13
        14
        15
        16
        17
        18
        19
        20
        21
        22
        23
        24
        25
        26
        27
        28
        29
        30
        31
        32
        33
        34
        35
        36
        37
        38
        39
        40
        41
        
        node default {
        
        }
        
        node 'puppet.example.com' {
          # ...
        }
        
        node 'puppet-agent-ubuntu.example.com' {
        
          include accounts
        
          resources { 'firewall':
            purge => true,
          }
        
          Firewall {
            before        => Class['firewall::post'],
            require       => Class['firewall::pre'],
          }
        
          class { ['firewall::pre', 'firewall::post']: }
        
        }
        
        node 'puppet-agent-centos.example.com' {
        
          include accounts
        
          resources { 'firewall':
            purge => true,
          }
        
          Firewall {
            before        => Class['firewall::post'],
            require       => Class['firewall::pre'],
          }
        
          class { ['firewall::pre', 'firewall::post']: }
        
        }
      3. By default, the Puppet agent service on your managed nodes will automatically check with the master once every 30 minutes and apply any new configurations from the master. You can also manually invoke the Puppet agent process in-between automatic agent runs.

        Log in to each managed node (as root) and run the Puppet agent:

        /opt/puppetlabs/bin/puppet agent -t
        
      4. To ensure the Puppet agent worked:

      Congratulations! You’ve successfully installed Puppet on a master and two managed nodes. Now that you’ve confirmed everything is working, you can create additional modules to automate configuration management on your nodes. For more information, review Puppet’s open source documentation. You can also install and use modules others have created on the Puppet Forge.

      More Information

      You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.

      Find answers, ask questions, and help others.

      This guide is published under a CC BY-ND 4.0 license.



      Source link

      Initial Server Setup with Debian 9


      Introduction

      When you first create a new Debian 9 server, there are a few configuration steps that you should take early on as part of the basic setup. This will increase the security and usability of your server and will give you a solid foundation for subsequent actions.

      Step One — Logging in as Root

      To log into your server, you will need to know your server’s public IP address. You will also need the password or, if you installed an SSH key for authentication, the private key for the root user’s account. If you have not already logged into your server, you may want to follow our guide on how to connect to your Droplet with SSH, which covers this process in detail.

      If you are not already connected to your server, go ahead and log in as the root user using the following command (substitute the highlighted portion of the command with your server’s public IP address):

      Accept the warning about host authenticity if it appears. If you are using password authentication, provide your root password to log in. If you are using an SSH key that is passphrase protected, you may be prompted to enter the passphrase the first time you use the key each session. If this is your first time logging into the server with a password, you may also be prompted to change the root password.

      About Root

      The root user is the administrative user in a Linux environment that has very broad privileges. Because of the heightened privileges of the root account, you are discouraged from using it on a regular basis. This is because part of the power inherent with the root account is the ability to make very destructive changes, even by accident.

      The next step is to set up an alternative user account with a reduced scope of influence for day-to-day work. We'll teach you how to gain increased privileges during the times when you need them.

      Step Two — Creating a New User

      Once you are logged in as root, we're prepared to add the new user account that we will use to log in from now on.

      Note: In some environments, a package called unscd may be installed by default in order to speed up requests to name servers like LDAP. The most recent version currently available in Debian contains a bug that causes certain commands (like the adduser command below) to produce additional output that looks like this:

      sent invalidate(passwd) request, exiting
      sent invalidate(group) request, exiting
      

      These messages are harmless, but if you wish to avoid them, it is safe to remove the unscd package if you do not not plan on using systems like LDAP for user information:

      This example creates a new user called sammy, but you should replace it with a username that you like:

      You will be asked a few questions, starting with the account password.

      Enter a strong password and, optionally, fill in any of the additional information if you would like. This is not required and you can just hit ENTER in any field you wish to skip.

      Step Three — Granting Administrative Privileges

      Now, we have a new user account with regular account privileges. However, we may sometimes need to do administrative tasks.

      To avoid having to log out of our normal user and log back in as the root account, we can set up what is known as "superuser" or root privileges for our normal account. This will allow our normal user to run commands with administrative privileges by putting the word sudo before each command.

      To add these privileges to our new user, we need to add the new user to the sudo group. By default, on Debian 9, users who belong to the sudo group are allowed to use the sudo command.

      As root, run this command to add your new user to the sudo group (substitute the highlighted word with your new user):

      Now, when logged in as your regular user, you can type sudo before commands to perform actions with superuser privileges.

      Step Four — Setting Up a Basic Firewall

      Debian servers can use firewalls to make sure only connections to certain services are allowed. Although the iptables firewall is installed by default, Debian does not strongly recommend any specific firewall. In this guide, we will install and use the UFW firewall to help set policies and manage exceptions.

      We can use the apt package manager to install UFW. Update the local index to retrieve the latest information about available packages and then install the firewall by typing:

      • apt update
      • apt install ufw

      Note: If your servers are running on DigitalOcean, you can optionally use DigitalOcean Cloud Firewalls instead of the UFW firewall. We recommend using only one firewall at a time to avoid conflicting rules that may be difficult to debug.

      Firewall profiles allow UFW to manage sets of firewall rules for applications by name. Profiles for some common software are bundled with UFW by default and packages can register additional profiles with UFW during the installation process. OpenSSH, the service allowing us to connect to our server now, has a firewall profile that we can use.

      You can see this by typing:

      Output

      Available applications: . . . OpenSSH . . .

      We need to make sure that the firewall allows SSH connections so that we can log back in next time. We can allow these connections by typing:

      Afterwards, we can enable the firewall by typing:

      Type "y" and press ENTER to proceed. You can see that SSH connections are still allowed by typing:

      Output

      Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6)

      As the firewall is currently blocking all connections except for SSH, if you install and configure additional services, you will need to adjust the firewall settings to allow acceptable traffic in. You can learn some common UFW operations in this guide.

      Step Five — Enabling External Access for Your Regular User

      Now that we have a regular user for daily use, we need to make sure we can SSH into the account directly.

      Note: Until verifying that you can log in and use sudo with your new user, we recommend staying logged in as root. This way, if you have problems, you can troubleshoot and make any necessary changes as root. If you are using a DigitalOcean Droplet and experience problems with your root SSH connection, you can log into the Droplet using the DigitalOcean Console.

      The process for configuring SSH access for your new user depends on whether your server's root account uses a password or SSH keys for authentication.

      If the Root Account Uses Password Authentication

      If you logged in to your root account using a password, then password authentication is enabled for SSH. You can SSH to your new user account by opening up a new terminal session and using SSH with your new username:

      After entering your regular user's password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

      You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

      To enhance your server's security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on Debian 9 to learn how to configure key-based authentication.

      If the Root Account Uses SSH Key Authentication

      If you logged in to your root account using SSH keys, then password authentication is disabled for SSH. You will need to add a copy of your local public key to the new user's ~/.ssh/authorized_keys file to log in successfully.

      Since your public key is already in the root account's ~/.ssh/authorized_keys file on the server, we can copy that file and directory structure to our new user account in our existing session with the cp command. Afterwards, we can adjust ownership of the files using the chown command.

      Make sure to change the highlighted portions of the command below to match your regular user's name:

      • cp -r ~/.ssh /home/sammy
      • chown -R sammy:sammy /home/sammy/.ssh

      Now, open up a new terminal session and using SSH with your new username:

      You should be logged in to the new user account without using a password. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

      You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

      Step Six — Completing Optional Configuration

      Now that we have a strong baseline configuration, we can consider a few optional steps to make the system more accessible. The following sections cover a few additional tweaks focused on usability.

      Installing man Pages

      Debian provides extensive manuals for most software in the form of man pages. However, the man command is not always included by default on minimal installations.

      Install the man-db package to install the man command and the manual databases:

      Now, to view the manual for a component, you can type:

      For example, to view the manual for the top command, type:

      Most packages in the Debian repositories include manual pages as part of their installation.

      Changing the Default Editor

      Debian offers a wide variety of text editors, some of which are included in the base system. Commands with integrated editor support, like visudo and systemctl edit, pass text to the editor command, which is mapped to the system default editor. Setting the default editor according to your preferences can help you configure your system more easily and avoid frustration.

      If your preferred editor is not installed by default, use apt to install it first:

      • sudo apt install your_preferred_editor

      Next, you can view the current default and modify the selection using the update-alternatives command:

      • sudo update-alternatives --config editor

      The command displays a table of the editors it knows about with a prompt to change the default:

      Output

      There are 8 choices for the alternative editor (providing /usr/bin/editor). Selection Path Priority Status ------------------------------------------------------------ * 0 /usr/bin/joe 70 auto mode 1 /bin/nano 40 manual mode 2 /usr/bin/jmacs 50 manual mode 3 /usr/bin/joe 70 manual mode 4 /usr/bin/jpico 50 manual mode 5 /usr/bin/jstar 50 manual mode 6 /usr/bin/rjoe 25 manual mode 7 /usr/bin/vim.basic 30 manual mode 8 /usr/bin/vim.tiny 15 manual mode Press <enter> to keep the current choice[*], or type selection number:

      The asterisk in the far left column indicates the current selection. To change the default, type the "Selection" number for your preferred editor and press Enter. For example, to use nano as the default editor given the above table, we would choose 1:

      Output

      Press <enter> to keep the current choice[*], or type selection number: 1 update-alternatives: using /bin/nano to provide /usr/bin/editor (editor) in manual mode

      From now on, your preferred editor will be used by commands like visudo and systemctl edit, or when the editor command is called.

      Where To Go From Here?

      At this point, you have a solid foundation for your server. You can install any of the software you need on your server now.



      Source link