5 ms·
Hope no one minds me sharing this here: http://lattejed.com/first-five-and-a-half-minutes-on-a-server-with-ansible http://lattejed.com/first-five-and-a-half-mi
by mbenjaminsmith 13y ago
Hope no one minds me sharing this here:
http://lattejed.com/first-five-and-a-half-minutes-on-a-server-with-ansible http://lattejed.com/first-five-and-a-half-minutes-on-a-serve...
I'm not surprised most of the comments are positive. Ansible is a great tool. I recently started using it and would recommend it without qualification.
The linked post contains a simple Ansible playbook for hardening a virgin (Linux, Ubuntu in this case) install as well as how to install Ansible (on OS X) and some of the basics.
- harrytuttle 13y agoGreat notes - thanks for posting. I do pretty much the same (literally!) but I don't set up unattended security updates after Ubuntu fucked up MySQL a couple of years back which took us down. We stage everything now using apt-offline. http://apt-offline.alioth.debian.org/ http://apt-offline.alioth.debian.org/
- joeyh 13y agoI was a bit put off by the very first thing being a download of unverified source code over a non-encrypted protocol, which was then run as root. Later worked out that you only did that on the ansible server, not on every server you deploy, but still. The use of files in /tmp in the ansible rules is also asking for trouble (unless ansible goes to lengths to securely write to files in /tmp without eg following symlinks). debconf-set-selections can read from stdin, or you can put the file somewhere better.
- mpdehaan2 13y agoJust to be clear -- by "unverified source code", you mean a github checkout. You can definitely clone github by HTTPs if you like. Ansible does in fact use your home directory for writing files by default and the locations are not predictable. There are also OS packages available.