Ansible and system updates

apt update
apt install ansible
apt install software-properties-common

Setup passwordless authentication with the servers you want to manage

This is useful if you want to automate processes via ssh without intervening by having to input the password to the remote server.

sshcopy-id user@ip_address

Setup passwordless sudo commands

In the server you want to manage with ansible, you’ll have to allow the sudo user to execute commands without a password. Since in this example we want to automate the updates-upgrades of the system, each time ansible sends the order to do an apt update (or other command with superuser privileges) the sudo password will be asked demanding a human interaction and ansible will not be able to successfully send the order to the remote server. There are 2 ways to do this. One is by typing visudo in debian to ope the configuration file /etc/sudoers and the other ways is by creating a new file inside /etc/sudoers.d/[name of your sudo user]. Once inside that file we need to add the following line:

# Allow admin user to run specific scripts and commands with superuser privileges
# without needing a password.
admin ALL=(ALL) NOPASSWD: ALL

If you want to be less permissive and only allow certain commands to be executed without a password these are the ones used in the playbooks in this example:

# Allow admin user to run specific scripts and commands with superuser privileges
# without needing a password.
Cmnd_Alias UPDATE_PKGS = /usr/bin/apt update, \
                          /usr/bin/apt upgrade, \
                          /usr/bin/apt dist-upgrade, \
                          /usr/bin/apt autoremove, \
                          /usr/bin/apt autoclean, \
admin ALL=(ALL) NOPASSWD: UPDATE_PKGS                          

Define where your ansible files are going to be placed

Given that this example will be tested in proxmox, I will locate them in /etc/ansible if is not created by defect. Furthermore, having the ansible configuration directtory in the main sever will ensure comms with all vms running inside unless the server is shut down.

Create an inventory file that includes your Proxmox VMs (or other servers you want to manage). For example, /etc/ansible/hosts:

Make sure your vms have a static ip!

[proxmox_vms]
vm1 ansible_host=192.168.1.101 ansible_ssh_user=admin
vm2 ansible_host=192.168.1.102 ansible_ssh_user=admin

Test your connectivity with the hosts:

ansible all -m ping

1. Daily Tasks Playbook: daily_tasks.yml

---
- name: Daily Maintenance Tasks
  hosts: webservers
  become: yes
  tasks:
    - name: Update the apt package cache
      apt:
        update_cache: yes

    - name: Clean up unused packages
      apt:
        autoremove: yes

    - name: Clear out outdated package files
      apt:
        autoclean: yes

2. Monthly Tasks Playbook: monthly_tasks.yml

---
- name: Monthly Maintenance Tasks
  hosts: webservers
  become: yes
  tasks:
    - name: Upgrade all installed packages (standard)
      apt:
        upgrade: safe  # Upgrades packages without removing any

    - name: Full upgrade of all installed packages (including system upgrades)
      apt:
        upgrade: dist  # Allows removal of obsolete packages and installation of new dependencies

3. Emergency Security Updates Playbook: security_updates.yml

---
- name: Urgent Security Upgrades
  hosts: webservers
  become: yes
  tasks:
    - name: Update the apt package cache
      apt:
        update_cache: yes

    - name: Upgrade only security updates
      apt:
        upgrade: dist  # Upgrades security updates only

Create a simple bash script to manage the urgent security upgrades and make it executable:

nano /etc/ansible/security_updates.sh

#!/bin/bash
# Check for security updates
SECURITY_UPDATES=$(apt list --upgradable 2>/dev/null | grep -i security)
if [ -n "$SECURITY_UPDATES" ]; then
echo "Security updates available. Running the Ansible playbook."
ansible-playbook -i /etc/ansible/hosts /etc/ansible/security_upgrades.yml
else
echo "No security updates available."
fi

chmod +x /etc/ansible/security_updates.sh

Cron Jobs for Execution

Now, here are the cron jobs to schedule the execution of these playbooks:

1. Daily Maintenance Tasks: Run every day at 2 AM.

0 2 * * * ansible-playbook -i /etc/ansible/hosts.ini /etc/ansible/daily_tasks.yml >> /var/log/ansible_daily.log 2>&1

2. Monthly Maintenance Tasks: Run on the first Saturday of every month at 2 AM.

0 2 * * 6 [ "$(date +\%d)" -le 7 ] && ansible-playbook -i /etc/ansible/hosts.ini /etc/ansible/monthly_tasks.yml >> /var/log/ansible_monthly.log 2>&1

3. Emergency Security Updates: Run daily at 3 AM (or adjust as needed) using a script that checks for security updates.

0 3 * * * /etc/ansible/security_updates.sh >> /var/log/ansible_security.log 2>&1  # Ensure the correct script name

The end