Security – Ansible security best practices

ansiblebest practicesSecurity

I am going to introduce Ansible into my data center, and I'm looking for some security best practice on where to locate the control machine and how to manage the SSH keys.

Question 1: the control machine

We of course need a control machine. The control machine has public SSH keys saved on it. If an attacker has access to the control machine, it potentially has access to the whole data center (or to the servers managed by Ansible). So is it better to have a dedicated control machine in data center or a remote control machine (like my laptop remotely connected to the data center)?

If the best practice is to use my laptop (which could be stolen, of course, but I could have my public keys securely saved online in the cloud or offline on a portable crypted device), what if I need to use some web interfaces with Ansible, like Ansible Tower, Semaphore, Rundeck or Foreman which needs to be installed on a centralised machine into the datacenter? How to secure it and avoid it to become a "single point of attack"?

Question 2: the SSH keys

Assume that I need to use Ansible to make some tasks which require to be executed by root (like installing software packages or something like this). I think the best practice is not to use the root user on controlled servers, but to add a normal user for Ansible with sudo permissions. But, if Ansible needs to make almost every task, it needs to have access to every commands through sudo. So, what is the best choice:

  • let Ansible use the root user (with its public key saved in ~/.ssh/authorized_keys
  • create a unprivileged user dedicated for Ansible with sudo access
  • let the Ansible user to run every commands through sudo specifying a password (which is unique needs to be known by every sysadmin which uses Ansible to control that servers)
  • let the Ansible user to run every commands through sudo without specifying any password
  • any other hints?

Best Answer

The bastion host (the ansible control center) belongs to a separate subnet. It shouldn't be directly accessible from outside, it shouldn't be directly accessible from the managed servers!

Your laptop is the least secure device of all. One stupid mail, one stupid flash vulnerability, one stupid guest Wifi and it gets pwned.

For servers, don't allow root access via ssh at all. Many audits scoff at this.

For ansible, let every admin use their own personal account on each target server, and let them sudo with passwords. This way no password is shared between two people. You can check who did what on each server. It's up to you if personal accounts allow login on password, ssh key only, or require both.

To clarify ansible doesn't require to use a single target login name. Each admin could and should have personal target login name.

A side note: Try to never create an account called some word (like "ansible" or "admin" or "cluster" or "management" or "operator") if it has a password. The only good name for account that has a password is a name of a human being, like "jkowalski". Only a human being can be responsible for the actions done via the account and responsible for improperly securing their password, "ansible" cannot.

Related Topic