Procedure

1. Create an Ansible playbook including the required role.

   The following example shows how to use roles through the roles: option for a given play:

   ---
   - hosts: webservers
     roles:
        - rhel-system-roles.network
        - rhel-system-roles.timesync

   For more information on using roles in playbooks, see Ansible documentation.

   See Ansible examples for example playbooks.

   Note

   Every role includes a README file, which documents how to use the role and supported parameter values. You can also find an example playbook for a particular role under the documentation directory of the role. Such documentation directory is provided by default with the rhel-system-roles package, and can be found in the following location:

   /usr/share/doc/rhel-system-roles/SUBSYSTEM/

   Replace SUBSYSTEM with the name of the required role, such as selinux, kdump, network, timesync, or storage.

2. Verify the playbook syntax:

   # ansible-playbook --syntax-check name.of.the.playbook

   The ansible-playbook command offers a --syntax-check option that you can use to verify the syntax of a playbook.

3. Execute the playbook on targeted hosts by running the ansible-playbook command:

   # ansible-playbook -i name.of.the.inventory name.of.the.playbook

   An inventory is a list of systems against which Ansible works. For more information on how to create and inventory, and how to work with it, see Ansible documentation.

   If you do not have an inventory, you can create it at the time of running ansible-playbook:

   If you have only one targeted host against which you want to run the playbook, use:

   # ansible-playbook -i host1, name.of.the.playbook

   If you have multiple targeted hosts against which you want to run the playbook, use:

   # ansible-playbook -i host1,host2,....,hostn name.of.the.playbook

Procedure

1. Install the rhel-system-roles package on the system that you want to use as a control node:

   # yum install rhel-system-roles

   If you do not have a Red Hat Ansible Engine Subscription, you can use a limited supported version of Red Hat Ansible Engine provided with your Red Hat Enterprise Linux subscription. In this case, follow these steps:

   1. Enable the RHEL Ansible Engine repository:

      # subscription-manager refresh
      
      # subscription-manager repos --enable ansible-2-for-rhel-8-x86_64-rpms

   2. Install Ansible Engine:

      # yum install ansible

Procedure

1. Optionally, review the inventory file for illustration purposes:

   #  cat /home/jdoe/<ansible_project_name>/inventory
   [testingservers]
   pdoe@192.168.122.98
   fdoe@192.168.122.226
   
   [db-servers]
   db1.example.com
   db2.example.com
   
   [webservers]
   web1.example.com
   web2.example.com
   192.0.2.42

   The file defines the [testingservers] group and other groups. It allows you to run Ansible Engine more effectively against a specific collection of systems.

2. Create a configuration file to set defaults and privilege escalation for Ansible Engine operations.

   1. Create a new YAML file and open it in a text editor, for example:

      #  vi /home/jdoe/<ansible_project_name>/ansible.cfg

   2. Insert the following content into the file:

      [defaults]
      inventory = ./inventory
      
      [privilege_escalation]
      become = true
      become_method = sudo
      become_user = root
      become_ask_pass = true

      The [defaults] section specifies a path to the inventory file of managed hosts. The [privilege_escalation] section defines that user privileges be shifted to root on the specified managed hosts. This is necessary for successful configuration of kernel parameters. When Ansible playbook is run, you will be prompted for user password. The user automatically switches to root by means of sudo after connecting to a managed host.

3. Create an Ansible playbook that uses the kernel_settings role.

   1. Create a new YAML file and open it in a text editor, for example:

      #  vi /home/jdoe/<ansible_project_name>/kernel_roles.yml

      This file represents a playbook and usually contains an ordered list of tasks, also called plays, that are run against specific managed hosts selected from your inventory file.

   2. Insert the following content into the file:

      ---
      - name: Configure kernel settings
        hosts: testingservers
      
        vars:
          kernel_settings_sysctl:
            - name: fs.file-max
              value: 400000
            - name: kernel.threads-max
              value: 65536
          kernel_settings_sysfs:
            - name: /sys/class/net/lo/mtu
              value: 65000
          kernel_settings_transparent_hugepages: madvise
      
        roles:
          - linux-system-roles.kernel_settings

      The name key is optional. It associates an arbitrary string with the play as a label and identifies what the play is for. The hosts key in the play specifies the hosts against which the play is run. The value or values for this key can be provided as individual names of managed hosts or as groups of hosts as defined in the inventory file.

      The vars section represents a list of variables containing selected kernel parameter names and values to which they have to be set.

      The roles key specifies what system role is going to configure the parameters and values mentioned in the vars section.

      Note

      You can modify the kernel parameters and their values in the playbook to fit your needs.

4. Optionally, verify that the syntax in your play is correct.

   #  ansible-playbook --syntax-check kernel-roles.yml
   
   playbook: kernel-roles.yml

   This example shows the successful verification of a playbook.

5. Execute your playbook.

   #  ansible-playbook kernel-roles.yml
   BECOME password:
   
   PLAY [Configure kernel settings]  ... PLAY RECAP **
   fdoe@192.168.122.226       : ok=10   changed=4    unreachable=0    failed=0    skipped=6    rescued=0    ignored=0
   pdoe@192.168.122.98        : ok=10   changed=4    unreachable=0    failed=0    skipped=6    rescued=0    ignored=0

   Before Ansible Engine runs your playbook, you are going to be prompted for your password and so that a user on managed hosts can be switched to root, which is necessary for configuring kernel parameters.

   The recap section shows that the play finished successfully (failed=0) for all managed hosts, and that 4 kernel parameters have been applied (changed=4).

6. Restart your managed hosts and check the affected kernel parameters to verify that the changes have been applied and persist across reboots.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/ethernet-static-IP.yml playbook with the following content:

   ---
   - name: Configure an Ethernet connection with static IP
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           - name: enp7s0
             type: ethernet
             autoconnect: yes
             ip:
               address:
                 - 192.0.2.1/24
                 - 2001:db8:1::1/64
               gateway4: 192.0.2.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 192.0.2.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/ethernet-static-IP.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/ethernet-static-IP.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/ethernet-dynamic-IP.yml playbook with the following content:

   ---
   - name: Configure an Ethernet connection with dynamic IP
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           - name: enp7s0
             type: ethernet
             autoconnect: yes
             ip:
               dhcp4: yes
               auto6: yes
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/ethernet-dynamic-IP.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/ethernet-dynamic-IP.yml

     The --ask-become-pass option makes sure that the ansible-playbook command promptsv for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/vlan-ethernet.yml playbook with the following content:

   ---
   - name: Configure a VLAN that uses an Ethernet connection
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           # Add an Ethernet profile for the underlying device of the VLAN
           - name: enp1s0
             type: ethernet
   	  interface_name: enp1s0
   	  autoconnect: yes
             state: up
   	  ip:
   	    dhcp4: no
   	    auto6: no
   
           # Define the VLAN profile
           - name: vlan10
             type: vlan
             ip:
               address:
                 - "192.0.2.1/24"
                 - "2001:db8:1::1/64"
               gateway4: 192.0.2.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 192.0.2.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             vlan_id: 10
   	  parent: enp1s0
             state: up

   The parent attribute in the VLAN profile configures the VLAN to operate on top of the enp1s0 device.

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/vlan-ethernet.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/vlan-ethernet.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/bridge-ethernet.yml playbook with the following content:

   ---
   - name: Configure a network bridge that uses two Ethernet ports
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           # Define the bridge profile
           - name: bridge0
             type: bridge
             interface_name: bridge0
             ip:
               address:
                 - "192.0.2.1/24"
                 - "2001:db8:1::1/64"
               gateway4: 192.0.2.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 192.0.2.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             state: up
   
           # Add an Ethernet profile to the bridge
           - name: bridge0-port1
             interface_name: enp7s0
             type: ethernet
             master: bridge0
             slave_type: bridge
             state: up
   
           # Add a second Ethernet profile to the bridge
           - name: bridge0-port2
             interface_name: enp8s0
             type: ethernet
             master: bridge0
             slave_type: bridge
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/bridge-ethernet.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/bridge-ethernet.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/bond-ethernet.yml playbook with the following content:

   ---
   - name: Configure a network bond that uses two Ethernet ports
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           # Define the bond profile
           - name: bond0
             type: bond
             interface_name: bond0
             ip:
               address:
                 - "192.0.2.1/24"
                 - "2001:db8:1::1/64"
               gateway4: 192.0.2.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 192.0.2.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             bond:
               mode: active-backup
             state: up
   
           # Add an Ethernet profile to the bond
           - name: bond0-port1
             interface_name: enp7s0
             type: ethernet
             master: bond0
             state: up
   
           # Add a second Ethernet profile to the bond
           - name: bond0-port2
             interface_name: enp8s0
             type: ethernet
             master: bond0
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/bond-ethernet.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/bond-ethernet.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/enable-802.1x.yml playbook with the following content:

   ---
   - name: Configure an Ethernet connection with 802.1X authentication
     hosts: node.example.com
     become: true
     tasks:
       - name: Copy client key for 802.1X authentication
         copy:
           src: "/srv/data/client.key"
           dest: "/etc/pki/tls/private/client.key"
           mode: 0600
   
       - name: Copy client certificate for 802.1X authentication
         copy:
           src: "/srv/data/client.crt"
           dest: "/etc/pki/tls/certs/client.crt"
   
       - name: Copy CA certificate for 802.1X authentication
         copy:
           src: "/srv/data/ca.crt"
           dest: "/etc/pki/ca-trust/source/anchors/ca.crt"
   
       - include_role:
           name: linux-system-roles.network
         vars:
           network_connections:
             - name: enp1s0
               type: ethernet
               autoconnect: yes
               ip:
                 address:
                   - 192.0.2.1/24
                   - 2001:db8:1::1/64
                 gateway4: 192.0.2.254
                 gateway6: 2001:db8:1::fffe
                 dns:
                   - 192.0.2.200
                   - 2001:db8:1::ffbb
                 dns_search:
                   - example.com
               ieee802_1x:
                 identity: user_name
                 eap: tls
                 private_key: "/etc/pki/tls/private/client.key"
                 private_key_password: "password"
                 client_cert: "/etc/pki/tls/certs/client.crt"
                 ca_cert: "/etc/pki/ca-trust/source/anchors/ca.crt"
                 domain_suffix_match: example.com
               state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/enable-802.1x.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/ethernet-static-IP.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/ethernet-connection.yml playbook with the following content:

   ---
   - name: Configure an Ethernet connection with static IP and default gateway
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           - name: enp1s0
             type: ethernet
             autoconnect: yes
             ip:
               address:
                 - 198.51.100.20/24
                 - 2001:db8:1::1/64
               gateway4: 198.51.100.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 198.51.100.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/ethernet-connection.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/ethernet-connection.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/add-static-routes.yml playbook with the following content:

   ---
   - name: Configure an Ethernet connection with static IP and additional routes
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           - name: enp7s0
             type: ethernet
             autoconnect: yes
             ip:
               address:
                 - 198.51.100.20/24
                 - 2001:db8:1::1/64
               gateway4: 198.51.100.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 198.51.100.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
               route:
                 - network: 192.0.2.0
                   prefix: 24
                   gateway: 198.51.100.1
                 - network: 203.0.113.0
                   prefix: 24
                   gateway: 198.51.100.2
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/add-static-routes.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/add-static-routes.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/configure-ethernet-device-with-ethtool-features.yml playbook with the following content:

   ---
   - name. Configure an Ethernet connection with ethtool features
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           - name: enp1s0
             type: ethernet
             autoconnect: yes
             ip:
               address:
                 - 198.51.100.20/24
                 - 2001:db8:1::1/64
               gateway4: 198.51.100.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 198.51.100.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             ethtool:
               feature:
                 gro: "no"
                 gso: "yes"
                 tx_sctp_segmentation: "no"
             state: up

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/configure-ethernet-device-with-ethtool-features.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/configure-ethernet-device-with-ethtool-features.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.

Procedure

1. Enable the RHEL Ansible repository, for example:

   # subscription-manager repos --enable ansible-2-for-rhel-8-x86_64-rpms

2. Install Ansible Engine:

   # yum install ansible

3. Install RHEL system roles:

   # yum install rhel-system-roles

4. Apply your playbook with an SELinux system role.

   The following command applies an example playbook, which is a part of the rhel-system-roles package. You can use this playbook as a template:

   # ansible-playbook -i host1,host2,host3 /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml

Procedure

1. Create a playbook that defines the required role:

   1. Create a new YAML file and open it in a text editor, for example:

      # vi logging-playbook.yml

   2. Insert the following content:

      ---
      - name: Deploying basics input and implicit files output
        hosts: all
        roles:
          - linux-system-roles.logging
        vars:
          logging_inputs:
            - name: system_input
              type: basics
          logging_outputs:
            - name: files_output
              type: files
          logging_flows:
            - name: flow1
              inputs: [system_input]
              outputs: [files_output]

2. Execute the playbook on a specific inventory:

   # ansible-playbook -i inventory-file /path/to/file/logging-playbook.yml

   Where:

   • inventory-file is the inventory file.
   • logging-playbook.yml is the playbook you use.

Verification

1. Test the syntax of the /etc/rsyslog.conf file:

   # rsyslogd -N 1
   rsyslogd: version 8.1911.0-6.el8, config validation run (level 1), master config /etc/rsyslog.conf
   rsyslogd: End of config validation run. Bye.

2. Verify that the system sends messages to the log:

   1. Send a test message:

      # logger test

   2. View the /var/log/messages log, for example:

      # cat /var/log/messages
      Aug  5 13:48:31 hostname root[6778]: test

      Where `hostname` is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Create a playbook that defines the required role:

   1. Create a new YAML file and open it in a text editor, for example:

      # vi logging-playbook.yml

   2. Insert the following content into the file:

      ---
      - name: Deploying remote input and remote_files output
        hosts: server
        roles:
          - linux-system-roles.logging
        vars:
          logging_inputs:
            - name: remote_udp_input
              type: remote
              udp_ports: [ 601 ]
            - name: remote_tcp_input
              type: remote
              tcp_ports: [ 601 ]
          logging_outputs:
            - name: remote_files_output
              type: remote_files
          logging_flows:
            - name: flow_0
              inputs: [remote_udp_input, remote_tcp_input]
              outputs: [remote_files_output]
      
      - name: Deploying basics input and forwards output
        hosts: clients
        roles:
          - linux-system-roles.logging
        vars:
          logging_inputs:
            - name: basic_input
              type: basics
          logging_outputs:
            - name: forward_output0
              type: forwards
              severity: info
              target: host1.example.com
              udp_port: 601
            - name: forward_output1
              type: forwards
              facility: mail
              target: host1.example.com
              tcp_port: 601
          logging_flows:
            - name: flows0
              inputs: [basic_input]
              outputs: [forward_output0, forward_output1]
      
      [basic_input]
      [forward_output0, forward_output1]

      Where host1.example.com is the logging server.

      Note

      You can modify the parameters in the playbook to fit your needs.

      Warning

      The logging solution works only with the ports defined in the SELinux policy of the server or client system and open in the firewall. The default SELinux policy includes ports 601, 514, 6514, 10514, and 20514. To use a different port, modify the SELinux policy on the client and server systems . Configuring the firewall through system roles is not yet supported.

2. Create an inventory file that lists your servers and clients:

   1. Create a new file and open it in a text editor, for example:

      # vi inventory.ini

   2. Insert the following content into the inventory file:

      [servers]
      server ansible_host=host1.example.com
      [clients]
      client ansible_host=host2.example.com

      Where: * host1.example.com is the logging server. * host2.example.com is the logging client.

3. Execute the playbook on your inventory.

   # ansible-playbook -i /path/to/file/inventory.ini /path/to/file/_logging-playbook.yml

   Where:

   • inventory.ini is the inventory file.
   • logging-playbook.yml is the playbook you created.

Verification steps

1. On both the client and the server system, test the syntax of the /etc/rsyslog.conf file:

   # rsyslogd -N 1
   rsyslogd: version 8.1911.0-6.el8, config validation run (level 1), master config /etc/rsyslog.conf
   rsyslogd: End of config validation run. Bye.

2. Verify that the client system sends messages to the server:

   1. On the client system, send a test message:

      # logger test

   2. On the server system, view the /var/log/messages log, for example:

      # cat /var/log/messages
      Aug  5 13:48:31 host2.example.com root[6778]: test

      Where host2.example.com is the host name of the client system. Note that the log contains the user name of the user that entered the logger command, in this case root.

Procedure

1. Enable the RHEL Ansible repository, for example:

   # subscription-manager repos --enable ansible-2-for-rhel-8-x86_64-rpms

2. Install Ansible Engine:

   # yum install ansible

3. Install RHEL system roles:

   # yum install rhel-system-roles

4. Prepare your playbook containing settings for Tang servers. You can either start from the scratch, or use one of the example playbooks from the /usr/share/ansible/roles/rhel-system-roles.nbde_server/examples/ directory.

   # cp /usr/share/ansible/roles/rhel-system-roles.nbde_server/examples/simple_deploy.yml ./my-tang-playbook.yml

5. Edit the playbook in a text editor of your choice, for example:

   # vi my-tang-playbook.yml

6. Add the required parameters. The following example playbook ensures deploying of your Tang server and a key rotation:

   ---
   - hosts: all
   
     vars:
       nbde_server_rotate_keys: yes
   
     roles:
       - linux-system-roles.nbde_server

7. Apply the finished playbook:

   # ansible-playbook -i host1,host2,host3 my-tang-playbook.yml

Procedure

1. Enable the RHEL Ansible repository, for example:

   # subscription-manager repos --enable ansible-2-for-rhel-8-x86_64-rpms

2. Install Ansible Engine:

   # yum install ansible

3. Install RHEL system roles:

   # yum install rhel-system-roles

4. Prepare your playbook containing settings for Clevis clients. You can either start from the scratch, or use one of the example playbooks from the /usr/share/ansible/roles/rhel-system-roles.nbde_client/examples/ directory.

   # cp /usr/share/ansible/roles/rhel-system-roles.nbde_client/examples/high_availability.yml ./my-clevis-playbook.yml

5. Edit the playbook in a text editor of your choice, for example:

   # vi my-clevis-playbook.yml

6. Add the required parameters. The following example playbook configures Clevis clients for automated unlocking of two LUKS-encrypted volumes by when at least one of two Tang servers is available:

   ---
   - hosts: all
   
     vars:
       nbde_client_bindings:
         - device: /dev/rhel/root
           encryption_key_src: /etc/luks/keyfile
           servers:
             - http://server1.example.com
             - http://server2.example.com
         - device: /dev/rhel/swap
           encryption_key_src: /etc/luks/keyfile
           servers:
             - http://server1.example.com
             - http://server2.example.com
   
     roles:
       - linux-system-roles.nbde_client

7. Apply the finished playbook:

   # ansible-playbook -i host1,host2,host3 my-clevis-playbook.yml

Procedure

1. Optional: Create an inventory file, for example inventory.file:

   $ touch inventory.file

2. Open your inventory file and define the hosts on which you want to request the certificate, for example:

   [webserver]
   server.idm.example.com

3. Create a playbook file, for example request-certificate.yml:

   • Set hosts to include the hosts on which you want to request the certificate, such as webserver.

   • Set the certificate_requests variable to include the following:

     • Set the name parameter to the desired name of the certificate, such as mycert.
     • Set the dns parameter to the domain to be included in the certificate, such as *.example.com.
     • Set the ca parameter to self-sign.

   • Set the rhel-system-roles.certificate role under roles.

     This is the playbook file for this example:

     ---
     - hosts: webserver
     
       vars:
         certificate_requests:
           - name: mycert
             dns: *.example.com
             ca: self-sign
     
       roles:
         - rhel-system-roles.certificate

4. Save the file.

5. Run the playbook:

   $ ansible-playbook -i inventory.file request-certificate.yml

Procedure

1. Optional: Create an inventory file, for example inventory.file:

   $ touch inventory.file

2. Open your inventory file and define the hosts on which you want to request the certificate, for example:

   [webserver]
   server.idm.example.com

3. Create a playbook file, for example request-certificate.yml:

   • Set hosts to include the hosts on which you want to request the certificate, such as webserver.

   • Set the certificate_requests variable to include the following:

     • Set the name parameter to the desired name of the certificate, such as mycert.
     • Set the dns parameter to the domain to be included in the certificate, such as www.example.com.
     • Set the principal parameter to specify the Kerberos principal, such as HTTP/www.example.com@EXAMPLE.COM.
     • Set the ca parameter to ipa.

   • Set the rhel-system-roles.certificate role under roles.

     This is the playbook file for this example:

     ---
     - hosts: webserver
       vars:
         certificate_requests:
           - name: mycert
             dns: www.example.com
             principal: HTTP/www.example.com@EXAMPLE.COM
             ca: ipa
     
       roles:
         - rhel-system-roles.certificate

4. Save the file.

5. Run the playbook:

   $ ansible-playbook -i inventory.file request-certificate.yml

Procedure

1. Optional: Create an inventory file, for example inventory.file:

   $ touch inventory.file

2. Open your inventory file and define the hosts on which you want to request the certificate, for example:

   [webserver]
   server.idm.example.com

3. Create a playbook file, for example request-certificate.yml:

   • Set hosts to include the hosts on which you want to request the certificate, such as webserver.

   • Set the certificate_requests variable to include the following:

     • Set the name parameter to the desired name of the certificate, such as mycert.
     • Set the dns parameter to the domain to be included in the certificate, such as www.example.com.
     • Set the ca parameter to the CA you want to use to issue the certificate, such as self-sign.
     • Set the run_before parameter to the command you want to execute before this certificate is issued or renewed, such as systemctl stop httpd.service.
     • Set the run_after parameter to the command you want to execute after this certificate is issued or renewed, such as systemctl start httpd.service.

   • Set the rhel-system-roles.certificate role under roles.

     This is the playbook file for this example:

     ---
     - hosts: webserver
       vars:
         certificate_requests:
           - name: mycert
             dns: www.example.com
             ca: self-sign
             run_before: systemctl stop httpd.service
             run_after: systemctl start httpd.service
     
       roles:
         - linux-system-roles.certificate

4. Save the file.

5. Run the playbook:

   $ ansible-playbook -i inventory.file request-certificate.yml

Procedure

1. Create a new playbook.yml file with the following content:

   ---
   - hosts: kdump-test
     vars:
       kdump_path: /var/crash
     roles:
       - rhel-system-roles.kdump

2. Optional: Verify playbook syntax.

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory_file /path/to/file/playbook.yml

Procedure

1. Create a new playbook.yml file with the following content:

   - hosts: all
     vars:
       storage_safe_mode: false
       storage_volumes:
         - name: data
           type: raid
           disks: [sdd, sde, sdf, sdg]
           raid_level: raid0
           raid_chunk_size: 32 KiB
           mount_point: /mnt/data
           state: present
     roles:
       - name: rhel-system-roles.storage

   Warning

   Device names can change in certain circumstances; for example, when you add a new disk to a system. Therefore, to prevent data loss, we do not recommend using specific disk names in the playbook.

2. Optional. Verify playbook syntax.

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory.file /path/to/file/playbook.yml

Procedure

1. Create a new playbook.yml file with the following content:

   - hosts: all
     vars:
       storage_safe_mode: false
       storage_pools:
         - name: my_pool
           type: lvm
           disks: [sdh, sdi]
           raid_level: raid1
           volumes:
             - name: my_pool
               size: "1 GiB"
               mount_point: "/mnt/app/shared"
               fs_type: xfs
               state: present
     roles:
       - name: rhel-system-roles.storage

   Note

   To create an LVM pool with RAID, you must specify the RAID type using the raid_level parameter.

2. Optional. Verify playbook syntax.

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory.file /path/to/file/playbook.yml

Procedure

1. Create a new playbook.yml file with the following content:

   - hosts: all
     vars:
       storage_volumes:
         - name: barefs
           type: disk
           disks:
            - sdb
           fs_type: xfs
           fs_label: label-name
           mount_point: /mnt/data
           encryption: true
           encryption_password: your-password
     roles:
      - rhel-system-roles.storage

2. Optional. Verify playbook syntax:

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory.file /path/to/file/playbook.yml

Procedure

1. Create a new playbook.yml file with the following content:

   ---
   - hosts: timesync-test
     vars:
       timesync_ntp_servers:
         - hostname: 2.rhel.pool.ntp.org
           pool: yes
           iburst: yes
     roles:
       - rhel-system-roles.timesync

2. Optional: Verify playbook syntax.

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory_file /path/to/file/playbook.yml

Procedure

1. Configure localhost in the the /etc/ansible/hosts Ansible inventory by adding the following content to the inventory:

   localhost ansible_connection=local

2. Create an Ansible playbook with the following content:

   ---
   - hosts: localhost
     vars:
       metrics_graph_service: yes
     roles:
       - rhel-system-roles.metrics

3. Run the Ansible playbook:

   # ansible-playbook name_of_your_playbook.yml

   Note

   Since the metrics_graph_service boolean is set to value="yes", grafana is automatically installed and provisioned with pcp added as a data source.

4. To view visualization of the metrics being collected on your machine, access the grafana web interface as described in Accessing the Grafana web UI.

Procedure

1. Add the name or IP of the machines you wish to monitor via the playbook to the /etc/ansible/hosts Ansible inventory file under an identifying group name enclosed in brackets:

   [remotes]
   webserver.example.com
   database.example.com

2. Create an Ansible playbook with the following content:

   ---
   - hosts: remotes
     vars:
       metrics_retention_days: 0
     roles:
       - rhel-system-roles.metrics

3. Run the Ansible playbook:

   # ansible-playbook name_of_your_playbook.yml

Procedure

1. Create an Ansible playbook with the following content:

   ---
   - hosts: localhost
     vars:
       metrics_graph_service: yes
       metrics_query_service: yes
       metrics_retention_days: 10
       metrics_monitored_hosts: ["database.example.com", "webserver.example.com"]
     roles:
       - rhel-system-roles.metrics

2. Run the Ansible playbook:

   # ansible-playbook name_of_your_playbook.yml

   Note

   Since the metrics_graph_service and metrics_query_service booleans are set to value="yes", grafana is automatically installed and provisioned with pcp added as a data source with the pcp data recording indexed into redis, allowing the pcp querying language to be used for complex querying of the data.

3. To view graphical representation of the metrics being collected centrally by your machine and to query the data, access the grafana web interface as described in Accessing the Grafana web UI.

Procedure

1. Create a new playbook.yml file with the following content:

   ---
   - name: Deploy session recording
     hosts: all
     vars:
       tlog_scope_sssd: some
       tlog_users_sssd:
         - recordeduser
   
     roles:
       - rhel-system-roles.tlog

   Where,

   • tlog_scope_sssd:

     • some specifies you want to record only certain users and groups, not all or none.

   • tlog_users_sssd:

     • recordeduser specifies the user you want to record a session from. Note that this does not add the user for you. You must set the user by yourself.

2. Optionally, verify the playbook syntax.

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i IP_Address /path/to/file/playbook.yml -v

1. Navigate to the folder where the SSSD configuration drop file is created:

   # cd /etc/sssd/conf.d

2. Check the file content:

   # cat /etc/sssd/conf.d/sssd-session-recording.conf

Procedure

1. Create a user and assign a password for this user:

   # useradd recordeduser
   # passwd recordeduser 

2. Relog to the system as the user you just created:

   # ssh recordeduser@localhost

3. Type "yes" when the system prompts you to type yes or no to authenticate.

4. Insert the recordeduser’s password.

   The system prompts a message to inform that your session is being recorded.

   ATTENTION! Your session is being recorded!

5. Once you have finished recording the session, type:

   # exit

   The system logs out from the user and closes the connection with the localhost.

1. Run the command below:

   # journalctl -o verbose -r

2. Search for the MESSAGE field of the tlog-rec recorded journal entry.

Procedure

1. On the CLI terminal, play the user session recording:

   # journalctl -o verbose -r

2. Search for the tlog recording:

   $ /tlog-rec

   You can see details such as:

   • The username for the user session recording
   • The out_txt field, a raw output encode of the recorded session
   • The identifier number TLOG_REC=ID_number
3. Copy the identifier number TLOG_REC=ID_number.

4. Playback the recording using the identifier number TLOG_REC=ID_number.

   # tlog-play -r journal -M TLOG_REC=ID_number