AnsibleでUbuntuの設定を行う

プレイブックの実行

1
2
3
ansible-playbook unattended-upgrades.yml -i hosts
ansible-playbook install-ubuntu-packages.yml -i hosts
ansible-playbook ufw.yml -i hosts

インベントリファイル「hosts」

初期設定を行うinitグループを設定する。

  • ansible_user/ansible_passwordは対象Ubuntuのログインユーザ、パスワード
  • ansible_become_passwordはsudo時のパスワード
1
2
3
4
5
6
7
8
[ubuntu]
target

[ubuntu:vars]
ansible_python_interpreter=/usr/bin/python3
ansible_port=※カスタマイズしたポート※
ansible_user=※ansible用ユーザ名※
ansible_ssh_private_key_file=~/.ssh/id_rsa

プレイブック「unattended-upgrades.yml」

セキュリティパッチや推奨パッチを自動インストールするUnattended-upgradesを設定する。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
---
- hosts: ubuntu

  vars:
  gather_facts: no
  become: true

  tasks:
    - name: Configure debconf
      debconf: name=unattended-upgrades question=unattended-upgrades/enable_auto_updates vtype=boolean value='true'

    - name: Install unattended-upgrades
      apt: name=unattended-upgrades

    - name: Configure unattended-upgrades
      command:
        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
        creates: /etc/apt/apt.conf.d/20auto-upgrades

    - name: Enable periodic for download and clean
      lineinfile:
        dest: /etc/apt/apt.conf.d/20auto-upgrades
        line: "{{ item }}"
      with_items:
        - 'APT::Periodic::Download-Upgradeable-Packages "1";'
        - 'APT::Periodic::AutocleanInterval "7";'

    - name: Enable upgrade recommend updates
      lineinfile:
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        regexp: '^//\t+\"\${distro_id}\:\${distro_codename}-updates\";'
        line: "\t\"${distro_id}:${distro_codename}-updates\";"

    - name: Enable automatic reboot
      lineinfile:
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        regexp: '^//Unattended-Upgrade::Automatic-Reboot \"false\";'
        line: "Unattended-Upgrade::Automatic-Reboot \"true\";"

    - name: Set automatic reboot time
      lineinfile:
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        regexp: '^//Unattended-Upgrade::Automatic-Reboot-Time \"02:00\";'
        line: "Unattended-Upgrade::Automatic-Reboot-Time \"04:00\";"

    - name: Enable remove unused kernel packages
      lineinfile:
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        regexp: '^//Unattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";'
        line: "Unattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";"

    - name: Enable remove unused dependencies
      lineinfile:
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        regexp: '^//Unattended-Upgrade::Remove-Unused-Dependencies \"false\";'
        line: "Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"

    - name: Reboot the machine (Wait for 5 min)
      reboot:
        reboot_timeout: 300

プレイブック「install-ubuntu-packages.yml」

パッケージを追加する。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
---
- hosts: ubuntu

  vars:
  gather_facts: no
  become: true

  tasks:
    - name: Install net-tools
      apt:
        update_cache: yes
        name:
          - net-tools

    - name: Install curl
      apt:
        update_cache: yes
        name:
          - curl

    - name: Install tree
      apt:
        update_cache: yes
        name:
          - tree

    - name: Install htop
      apt:
        update_cache: yes
        name:
          - htop

プレイブック「ufw.yml」

ファイアウォールを有効化する。
デフォルトDENYでポート番号を変更したSSHポートのみ許可する

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
---
- hosts: ubuntu

  vars:
    - sshd_port: "{{ lookup('env', 'SSHD_PORT') }}"
  gather_facts: no
  become: true

  tasks:
    - name: Deny all access from any
      ufw:
        default: deny
        direction: incoming

    - name: Allow all access to port {{ sshd_port }} (SSH)
      ufw:
        rule: allow
        proto: tcp
        port: "{{ sshd_port }}"

    - name: Enable firewall
      ufw:
        state: enabled