Install Ansible
In this section, we will proceed to install the Ansible server. To be able to deploy using Ansible, we need to have the tool installed on a single server. From this control server, Ansible will access other endpoints and execute the playbooks configured for any type of deployment or installation.
In the example we will follow in this guide, we have the following infrastructure.
Ansible server
Wazuh server
Wazuh agent
Note
OpenSSH Compatibility: Ansible version 1.3 and later uses native OpenSSH for remote communication.
Windows endpoints
Windows endpoints are supported by Ansible from version 1.7 via the remote execution of PowerShell. As opposed to Linux endpoints, it is necessary to do some pre-work before being able to use Ansible on Windows endpoints. Please refer to the Windows Guide in the official documentation of Ansible.
The following minimum requirements should be met to use Ansible on Windows endpoints:
Windows versions under current and extended support from Microsoft. Ansible can manage desktop OSs including Windows 7, 8.1, and 10, and server OSs including Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, and 2019.
PowerShell 3.0 or newer.
At least .NET version 4.0 should be installed on the Windows endpoint.
A WinRM listener should be created and activated.
Before deploying on your Windows endpoints, you must set Ansible to use port 5986
. Edit the /etc/ansible/hosts
file and add a configuration block for the Windows agents. For example:
[windows_agents]
agent1 ansible_host=192.168.1.101 ansible_port=5986
agent2 ansible_host=192.168.1.102 ansible_port=5986
agent3 ansible_host=192.168.1.103 ansible_port=5986
Where:
windows_agents
is a host group name for the Windows agents.agent1
,agent2
, andagent3
are names for each host.192.168.1.101
–103
are the respective Windows host IP addresses.
Make sure to replace these values with your Windows agents actual data. Add and remove lines accordingly.
Installation on CentOS/RHEL/Fedora
Install the EPEL repository:
# yum -y install epel-release
Install Ansible:
# yum install ansible
Install Ansible using pip.
# pip3 install --upgrade --ignore-installed pip setuptools --user # python3 -m pip install --user ansible
Installation on Debian/Ubuntu
For Debian and Ubuntu, we will use the Ansible PPA repository. The steps are as follows:
Install required dependencies:
# apt-get update # apt-get install lsb-release software-properties-common
Setup ansible repository:
# apt-add-repository -y ppa:ansible/ansible # apt-get update
# echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu trusty main" | sudo tee -a /etc/apt/sources.list.d/ansible-debian.list # apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367 # apt-get update
Finally, install ansible:
# apt-get install ansible
Remote Connection
Ansible is an agentless automation platform. Hence, it relies on SSH connections to make deployments to remote endpoints. These connections can be made from the Ansible server using SSH key-pairing.
Configuring SSH key-pairing
Our Ansible server will need to connect to the other endpoints. Let’s see how to make this connection between our ansible server and the machine where we will install the Wazuh server. This procedure has to be repeated for each machine we want to connect to the Ansible server. For example, the endpoints where Wazuh agents will be deployed.
The first step is to generate the SSH authentication key pair for the root user of the Ansible server using the ssh-keygen tool.
Switch to root and navigate to the $HOME directory of the Ansible server.
$ sudo su # cd ~
Generate an authentication key pair for SSH. If you wish to, you can include a passphrase.
# ssh-keygen
Check the permissions of the generated keys.
# ls -la ~/.ssh
id_rsa
must have restrictive permissions (600 or “- r w - - - - - - -“).drwx------. 2 root root 57 Mar 18 10:06 . dr-xr-x---. 5 root root 210 Mar 18 08:44 .. -rw-------. 1 root root 1675 Mar 18 12:34 id_rsa -rw-r--r--. 1 root root 408 Mar 18 12:34 id_rsa.pub -rw-r--r--. 1 root root 175 Mar 18 10:14 known_hosts
In addition, the
/root/.ssh/
directory must have its permissions set to700 (d r w x - - - - - -)
. The permissions can be set using the command below:# chmod 700 ~/.ssh/
Now, proceed to copy the public key of the Ansible server to the ~/.ssh/authorized_keys file in the $HOME directory of the remote system (the Wazuh server in this example).
On the remote system, install openssh-server if it is not installed.
# yum install openssh-server
# apt-get install openssh-server
Start the SSH service.
# systemctl start sshd
# service sshd start
Move to the $HOME directory of the remote system.
$ cd ~
Check for the
.ssh
directory. If it does not exist, create the.ssh
directory and assign the appropriate permissions to it:$ mkdir .ssh $ chmod 700 .ssh/
If the
authorized_keys
file does not exist in the.ssh/
directory, create it with the appropriate permissions, otherwise public key authentication will not work properly:$ touch .ssh/authorized_keys $ chmod 644 .ssh/authorized_keys
Return to the Ansible server and add the public key (
id_rsa.pub
) of the Ansible server to the~/.ssh/authorized_keys
file in the $HOME directory of the Wazuh server using SSH.From the Ansible server, run the following command:
# cat ~/.ssh/id_rsa.pub | ssh centos@192.168.33.31 "cat >> ~/.ssh/authorized_keys"
When we read the Wazuh server
~/.ssh/authorized_keys
, we can see it contains the public key of the ansible server.$ cat .ssh/authorized_keys
Before the public key authentication mechanism can be tested, we have to verify that the SSH configuration on the remote endpoint allows it. To do this, open the file
/etc/ssh/sshd_config
on the Wazuh server.# vi /etc/ssh/sshd_config
Check that the following lines are uncommented:
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
Restart the ssh service.
# systemctl restart sshd
# service sshd restart
Verify that the authentication with the public key works. Test from the Ansible server.
# ssh centos@192.168.33.31
It is expected that we will gain access without having to enter a password.
Testing the Ansible connection to remote endpoints
Add endpoints for management by Ansible.
This is done by including the hostname or IP Address in
/etc/ansible/hosts
on our Ansible server. In this case, we intend to use the Ansible playbooks to deploy the Wazuh indexer, dashboard, and manager on one server (all-in-one deployment). The IP address of the server is192.168.33.31
and the user iscentos
.We proceed to add the following entry to the
/etc/ansible/hosts
file:[all_in_one] 192.168.33.31 ansible_ssh_user=centos
Note
Python 3 usage: In some systems, such as Ubuntu 18, we may have problems with the use of Python interpreter due to its version and the default path where Ansible checks for it. If this happens, we must add the following line to the Ansible host file:
<endpoint_IP> ansible_ssh_user=<ssh_user>
ansible_python_interpreter=/usr/bin/python3
Attempt a connection with the remote endpoints using the ping module.
# ansible all -m ping
The expected output is:
192.168.33.31 | SUCCESS => { "changed": false, "ping": "pong" }
This way, we confirm that the Ansible server reaches the remote system.
Playbooks and Roles
We can obtain the necessary playbooks and roles for the installation of the Wazuh server components, and Wazuh agents by cloning the wazuh-ansible repository in /etc/ansible/roles
.
On the Ansible server, the following commands are run:
# cd /etc/ansible/roles/
# sudo git clone --branch v4.7.5 https://github.com/wazuh/wazuh-ansible.git
# ls
wazuh-ansible