Changes

== PART 1: Simplest Non-privileged task example =====Creating Create non-privileged tasks: Getting the hostname of remote machines===

==PART 2: Privileged Tasks Examples =Creating ====Creat privileged tasks: install and remove rpm package on remote machines===

== Part 2: Set up more administrative tasks== :Let's pretend that we need collect the disk usage on several machines so that we can plan Create remote task for storage maintenance. We'll set up a simple example of such a deployment here. === Getting the disk usage on remote worker =updating rpm packages == :Add a getDiskUsage() new function called "updatePackage" to your fabfile.py fileaccording to the following requirements::* Accept optional function argument as the rpm package name:<source lang="python"># * If no function argument was given when called, default to get all the disk usage on remote workerpackages installeddef getDiskUsage(): The output of the updatePackage when executed, should produce similar output as shown below: current_time :1. Update a single package:<source lang= run('datebash')> diskusage = run('df -H') header = 'Current Disk Usage at '+current_time print(header) print(diskusage)fab updatePackage:tree

Loaded plugins:Note that each call to "run()" will run a command on the worker. In this function we get the date/time of the remote work, and then get the disk usage. The print() function print out both the values returned. :If you try to run it the same way as before: <pre>$ fab --fabfile=fabfile.py -H 192.168.122.169 getDiskUsage</pre> :You should get the following output:<source lang="bash">fastestmirror[rchan@centos7 lab8]$ fab --fabfile=fabfile.py -H 192.168.122.169 getDiskUsageLoading mirror speeds from cached hostfile[192.168.122.169] Executing task 'getDiskUsage'[192.168.122.169] run: date[192.168.122.169] out: Sun Nov 10 13:17:16 EST 2019[192.168.122.169] out:  [192.168.122.169] run: df -H[192.168.122.169] out: Filesystem Size Used Avail Use% Mounted on[192.168.122.169] out: devtmpfs 947M 0 947M 0% /dev[192.168.122.169] out* base: tmpfs 964M 0 964M 0% /dev/shm[192.168.122less.169] out: tmpfs 964M 9cogeco.7M 954M 2% /runnet[192.168.122.169] out: tmpfs 964M 0 964M 0% /sys/fs/cgroup[192.168.122.169] out* extras: /dev/mapper/centos-root 7.7G 5.6G 2.1G 73% /[192.168mirror.122ca.169] out: /dev/vda1 1planethoster.1G 298M 766M 29% /bootnet[192.168.122.169] out: tmpfs 193M 17k 193M 1% /run/user/42[192.168.122.169] out* updates: tmpfs 193M 0 193M 0% /run/user/1000[192.168less.122cogeco.169] out: net Current Disk Usage at Sun Nov 10 13:17:16 EST 2019Filesystem Size Used Avail Use% Mounted ondevtmpfs 947M 0 947M 0% /devtmpfs 964M 0 964M 0% /dev/shmtmpfs 964M 9.7M 954M 2% /runtmpfs 964M 0 964M 0% /sys/fs/cgroup/dev/mapper/centos-root 7.7G 5.6G 2.1G 73% //dev/vda1 1.1G 298M 766M 29% /boottmpfs 193M 17k 193M 1% /run/user/42tmpfs 193M 0 193M 0% /run/user/1000No packages marked for update

Disconnecting from 192myvmlab.168senecacollege.122ca:7200.169..done. done[raymond.chan@mtrx-node05pd lab8]$

 === :2. Update all the rpm packages on remote worker ===:Let's pretend that we need to update software packages installed on several machines due to security patches. Let's name the task as 'performSoftwareUpdate()'package:<source lang="python"'bash'># to perform software update on remote workerdef performSoftwareUpdate()fab updatePackage: status = run('yum update -y') print(status)

: Do a syntax check with The following output had been trimmed, only showing the "fab -l" command.: When you try to run it the same way as before, you encounter some issue as shown belowfirst few lines:<source lang="'bash"'>[rchan@centos7 lab8]$ fab --fabfile=fabfile.py -H 192.168.122.169 performSoftwareUpdate[192.168myvmlab.122senecacollege.169ca] Executing task 'performSoftwareUpdateupdatePackage'[192.168myvmlab.122senecacollege.169ca] runsudo: yum update -y[192myvmlab.168senecacollege.122ca] out: sudo password:[myvmlab.169senecacollege.ca] out: Loaded plugins: fastestmirror, langpacks[192myvmlab.senecacollege.168ca] out: Loading mirror speeds from cached hostfile[myvmlab.122senecacollege.169ca] out: You need to be root to perform this command * base: less.cogeco.net[192myvmlab.168senecacollege.122ca] out: * extras: centos.169mirror.ca.planethoster.net[myvmlab.senecacollege.ca] out: * updates: less.cogeco.net...

Fatal error Verifying : run() received nonzero return code 1 while executing!systemd-219-73.el7_8.5.x86_64 53/54 Verifying : systemd-libs-219-73.el7_8.5.x86_64 54/54

RequestedRemoved: yum update -yExecuted kernel.x86_64 0: /bin/bash -l -c "yum update 3.10.0-y"862.el7

Aborting.Installed:Disconnecting from 192.168.122 kernel.169... done.</source>x86_64 0: As you already know, you need superuser privilege in order to perform software update on a Linux system3. There are two ways to do it on Fabric10. The first one is simple0-1127. Edit you fabfile13.py and change the env1.user line as shown below:<source lang="python">el7

envUpdated: bind-export-libs.user = 'root'x86_64 32:9.11.4-16.P2.el7_8.6 binutils.x86_64 0:2.27-43.base.el7_8.1 ca-certificates.noarch 0:2020.2.41-70.0.el7_8 device-mapper.x86_64 7:1.02.164-7.el7_8.2 device-mapper-event.x86_64 7:1.02.164-7.el7_8.2 device-mapper-event-libs.x86_64 7:1.02.164-7.el7_8.2 device-mapper-libs.x86_64 7:1.02.164-7.el7_8.2 kernel-tools.x86_64 0:3.10.0-1127.13.1.el7 kernel-tools-libs.x86_64 0:3.10.0-1127.13.1.el7 lvm2.x86_64 7:2.02.186-7.el7_8.2 lvm2-libs.x86_64 7:2.02.186-7.el7_8.2 microcode_ctl.x86_64 2:2.1-61.10.el7_8 net-snmp.x86_64 1:5.7.2-48.el7_8.1 net-snmp-agent-libs.x86_64 1:5.7.2-48.el7_8.1 net-snmp-libs.x86_64 1:5.7.2-48.el7_8.1 net-snmp-utils.x86_64 1:5.7.2-48.el7_8.1 ntp.x86_64 0:4.2.6p5-29.el7.centos.2 ntpdate.x86_64 0:4.2.6p5-29.el7.centos.2 python-perf.x86_64 0:3.10.0-1127.13.1.el7 rsyslog.x86_64 0:8.24.0-52.el7_8.2 selinux-policy.noarch 0:3.13.1-266.el7_8.1 selinux-policy-targeted.noarch 0:3.13.1-266.el7_8.1 systemd.x86_64 0:219-73.el7_8.8 systemd-libs.x86_64 0:219-73.el7_8.8 systemd-sysv.x86_64 0:219-73.el7_8.8 yum-plugin-fastestmirror.noarch 0:1.1.31-54.el7_8

== Part 3: Setting and Checking Security Configuration ==Done.Disconnecting from myvmlab.senecacollege.ca: Recall that in our OPS courses we've been using iptables instead of firewalld, which is installed by default in CentOS7200. Let's make sure that our workers have that set up as well. In the same '''fabfile.py''' you've been using all along, add a new function like this:done. : <source lang="python"># Will uninstall firewalld and replace it with iptablesdef setupFirewall(): run("yum -y -d1 remove firewalld") run("yum [raymond.chan@mtrx-y -d1 install iptables-services") run("systemctl enable iptables") run("systemctl start iptables")node05pd lab8]$

: That should by now look pretty obvious. On the worker you're going to uninstall firewalld, install iptables, and make sure that the iptables service is running. : Execute the function for worker1 and double-check that it worked.: <font color='red'>'''**Warning**''' </font>Do not do this on your vm on myvmlab. If you do, you may lock yourself out for good. === Check firewall configuration === Lab Exercise: To check your firewall configuration your remote worker, you can retrieve its current configuration by creating another Create a Fabric task called "getFirewallConfiguremakeUser(). Let's put the following code to your fabfile.py:<source lang="python">def getFirewallConfig(): fw_config = Study the Fabric API run("iptables -L -n -v") print(fw_config)</source> : Try to run the getFirewallConfig() task the same way as before.: Troubleshoot if you encounter any issue. = INVESTIGATION 3: Multiplying your work = : After completing all the previous parts of the lab - you should have a working fabfile.py with three working functions: getDiskUsage, sudo(), performSoftwareUpdateand put() and getFirewallConfig(). '''** Optional **'''You were asked to test utilize them on worker1. Now let's run these three functions on all your workers at the same time. The command is almost the same, except for the list of IP addresses: <source lang="bash">fab --fabfile=fabfile.py -H 192.168.122.169,192.168.122.170,192.168.122.171,192.168.122.172 getDiskUsage</source> : Again - your IP addresses will be different but the command will be the same. : You can also run all three tasks on all the workers at the same time, by adding any task to your fabfile.py:<source lang="python">def doAllThree(): getDiskUsage() getFirewallConfig() performSoftwareUpdate()</source>: And run the following command on your controller: <source lang="bash">fab --fabfile=fabfile.py -H 192.168.122.169,192.168.122.170,192.168.122.171,192.168.122.172 doAllThree</source> And imagine that you might have 10 tasks to be done on 10, 50, 100 servers - could you do it without the automation? = INVESTIGATION 4 - Apply fabfile.py to your VM on myvmlab === Replace run() function calls with sudo() ==: Since your account on your vm on myvmlab is create a regular user with sudo privilege. You need to make the following changes to your fabfile.py before applying it to your vm on myvmlab::* Change env.user from 'root' to your account on your vm in myvmlab.:* Change all the commands that need super user privilege from calling the run() function to instead calling the sudo() function. Here is an example on replacing run() with sudo():<source lang="python"> def getFirewallConfig(): fw_config = sudo("iptables -L -n -v") print(fw_config)</source> : Test your updated fabfile.py until you get the same result as when you apply it to your own worker VM. == Create a Fabric new task called makeUser() ==

::* create a new user called "ops435p" with home directory "/home/ops435p".::* add it to the sudo group called "wheel". ::* add ask your professor's for a ssh public key and add it to the file named "authorized_keys" in the ~ops435p/.ssh directory. Make sure that you set the proper permissions on both the directory ~ops435p/.ssh and the file "~ops435p/.ssh/authorized_keys.

:Test Run the new task makeUser() on your local VM first, and deploy to your vm on myvmlab.:After the successful deployment of the Verify and confirm that your new makeUser() task on your vm on myvmlab, ask your professor to verify and confirm that the new user account "ops435p" on myvmlab has been created is working correctly.

:'''Have Ready to Show Your Instructor:'''* Complete all the parts of the lab and upload the version of your fabfile.py which works on your vm on myvmlab to Blackboardby the due date.

[[Category:OPS435-Python]][[Category:rchan]]