Ansible allows you to configure connections used for
communication with the managed hosts and also allows privilege
escalation for playbooks and play escalation.
So once you run the host, you need to escalate privileges,
and Ansible will need to know about this.
Also, Ansible needs to know if you're connecting the user as root or not,
and whether we should escalate privileges to root.
And then, how should Ansible become root, and the default is with sudo.
If you need different escalation commands such as su,
this is available too, and it just needs to be expanded to Ansible,
and those parameters can be passed with arguments in the
command line or in the ansible.cfg file.
In this demo,
we're going to prepare the host more and we're going
to manage privilege escalation.
We will also generate public and private key pairs,
and I'll copy this to the managed hosts.
We will also start our journey using some ad hoc commands.
So in this demo we're going to use SSH keys for
passwordless connection to the remote hosts.
We're also going to use passwordless privilege escalation.
So to make the automation process more seamless,
we will generate an SSH authentication key pair so you don't have to
type in a password every time you want to run,
for example, a playbook.
Before you can perform key‑based authentication on your target hosts,
you will need to apply the public key from the key pair
that we just generated to each host.
I will demonstrate in copying this just to two of my hosts,
but in total, I have done this for all of them.
Next we're going to use an ad hoc command,
and with this ad hoc command we're going to call the user module.
With this command, we specify the ‑i for the inventory,
which is in the current working directory called pluralsight.
We also have the ‑m argument.
This argument is used to specify the module that we want to call.
In this case, we are calling the user module.
Notice now we're using the ‑u, as we're logging in as root.
For secure management,
we will use a ‑k command line option to prompt for the SSH password.
Here you will need to enter the password over and over again.
Throughout this course,
we'll be making this more seamless so we don't need
to enter all of these arguments, but for now,
let's enter these for demonstration purposes.
So I'm running this on the Ansible group that consists of two hosts.
As you can see, we have a CHANGED status,
which means that there has been a change on the managed
host that we issued this command to.
Notice that the user has been created by the user module.
By default with Rocky Linux, when you create a user,
we also get a home directory created for that user for us.
We will carry out the same action for our ubuntu host,
but this time we need to specify some different arguments,
as a home directory isn't the default operation
when you create a user on Ubuntu.
Notice that we're using the ‑K command line option to
prompt for privilege escalation password.
For secure privilege escalation,
we can use the ‑b and the ‑K command line options.
As already mentioned at the start, this may not be convenient all of the time,
so here we can configure passwordless sudo,
and we can do this in Ansible.
I'm also going to set passwords for the user pluralsight in the Ansible group.
I've already done this on the ubuntu host.
Here we're using root to log in and the ‑k argument to manage the privileges.
Now that this is done, let us quickly ping,
but notice we have a Permission denied and an unreachable status of true.
For this to work with our current config,
we need to specify the ‑u argument for root access.
We'll be streamlining this very soon.
Notice now we have a ping status of pong,
which means that the ping has been a success.
We will next run the command module,
but notice that we don't use the ‑m argument.
We don't need to specify the ‑m argument for the command module,
as this is the default module in Ansible.
And here we're going to be calling the setup module.
Notice that we need the ‑m argument for this module,
as the setup module is not the default module.
As we scroll to the very top, we can see ansible_facts,
and this is a type of variable.
These Ansible facts, which will be discussed more later,
have been processed manually,
but we can also run Ansible facts gathering with playbooks,
which is implicit.
Next,
let us streamline the configuration of Ansible a little bit
more so we don't have to enter all of the command arguments
that we did at the start of the demo.
So here we're going to be setting up privilege escalation.
So first we need to generate a sudoers file,
and we were writing this to attempt sudoers.
This will make the file available on the controller host.
The NOPASSWD allows a user to do privilege
escalation without entering a password.
Next we need to copy this to our managed hosts,
and we're going to do this one by one.
Firstly, we'll start with rocky1.
As you can see we have a changed status of true.
Next we'll do this for rocky2.
As you can see, we have a CHANGED status.
And finally, we will do this for the ubuntu host.
Next, As we end this demo,
let's do a quick verification on all hosts in the inventory,
where we specify the all parameter after the inventory command,
and this time we'll use the command module,
but for demonstration purposes we'll call out this module
explicitly by using the ‑m command, but this is not a requirement,
as the command module is the default Ansible module.