Ansible – Ryan Schulze

How to use ansible to scan for Spectre/Meltdown vulnerable hosts

February 1, 2018April 1, 2022Ryanmeltdown, spectre

First of all head on over to github and download a spectre-meltdown-checker that supports JSON output. Now all we need is a ansible playbook that calls that script:

- name: Run Spectre/Meltdown checker on hosts
  hosts: all
  gather_facts: false
  tasks:
    - script: tools/spectre-meltdown-checker.sh --batch json --live
      register: spectre_output
      failed_when: false

    - set_fact: 
        spectre_json: "{{ spectre_output.stdout|from_json }}"

    - name: Output vulnerability status
      debug: 
        msg: "Vulnerable to {{ item.NAME }} - {{ item.INFOS }}"
      with_items: "{{ spectre_json }}"
      failed_when: item.VULNERABLE
      when: item.VULNERABLE

- name: Run Spectre/Meltdown checker on hosts

hosts: all

gather_facts: false

tasks:

- script: tools/spectre-meltdown-checker.sh --batch json --live

failed_when: false

- set_fact:

spectre_json: "{{ spectre_output.stdout|from_json }}"

- name: Output vulnerability status

debug:

msg: "Vulnerable to {{ item.NAME }} - {{ item.INFOS }}"

with_items: "{{ spectre_json }}"

failed_when: item.VULNERABLE

when: item.VULNERABLE

Important is to adjust the path to spectre-meltdown-checker.sh in the script: task (the path is relative to wherever your playboook file is). Adapt to your needs however you want. It is basically just feeding the output of the script into the from_json filter, storing it in a variable and then iterating over the result via with_items.

Example output:

(vulnerable to CVE-2017-5715 since Intel retracted their microcode updates and haven’t released new ones yet)

Bash function to run commands against ansible hosts

July 10, 2017August 14, 2017Ryanbash

I haven’t posted anything ansible related in a while, so here is a nifty little function I regularly use when I want to execute something on all (or a subset) of ansible hosts. It’s just a wrapper around ansible host -m script -a scriptname.sh but adds –tree so that the output is stored and can easily be parsed by jq

ansible_run() {
	local ansible_directory="${HOME}/svn/ansible/"
	local command=${1}
	local target=${2:-all}
	local dir="${HOME}/ansible_output/${RANDOM:0:5}"
	local startdir=
	local script=

	startdir="$(pwd)"
	script="$(mktemp)"
	mkdir -p "${dir}"
	if [[ $? -eq 0 ]] ; then
		{
			echo "#!/usr/bin/env bash"
			echo "${command}"
			echo
		} > "${script}"
		cd "${ansible_directory}" && time ansible "${target}" -m script -a "${script}" --tree "${dir}"
		rm "${script}"
		echo -e "\n${dir}\n"
	fi
	rmdir --ignore-fail-on-non-empty "${dir}"
	cd "${startdir}" || exit
}

ansible_run() {

local ansible_directory="${HOME}/svn/ansible/"

local command=${1}

local target=${2:-all}

local dir="${HOME}/ansible_output/${RANDOM:0:5}"

local startdir=

local script=

startdir="$(pwd)"

script="$(mktemp)"

mkdir -p "${dir}"

if [[ $? -eq 0 ]] ; then

{

echo "#!/usr/bin/env bash"

echo "${command}"

echo

} > "${script}"

cd "${ansible_directory}" && time ansible "${target}" -m script -a "${script}" --tree "${dir}"

rm "${script}"

echo -e "\n${dir}\n"

rmdir --ignore-fail-on-non-empty "${dir}"

cd "${startdir}" || exit

}

Usage example:

$ ansible_run "iptables -S | grep -E '^-P (INPUT|FORWARD)'"
...
/home/user/ansible_output/6599

$ cd ${HOME}/ansible_output/6599
$ jq -r .stdout ./*

$ ansible_run "iptables -S | grep -E '^-P (INPUT|FORWARD)'"

...

/home/user/ansible_output/6599

$ cd ${HOME}/ansible_output/6599

$ jq -r .stdout ./*

How to easily switch between ansible versions

July 14, 2016October 20, 2016Ryanansible, bash

Lately I’ve run into issues with different versions of ansible (1.9 handling async better, 2.x having more modules and handling IPv6 better) and having to test playbooks and roles against different versions to make sure they work. TO make life easier I put this little function in my .bashrc to switch back and forth between ansible versions. It checks out the specified version from github if it needs to, and switches over to it (just for that terminal, not the system). Usage is straight forward ansible_switch <branch> , i.e. ansible_switch 2.1 (or whatever branch you want, here is a list of all branches).

It is currently limited to stable branches, but you can change line 6 from stable- to whatever you want (or remove the prefix completely). If you have a github account you also may want to change from https to ssh by using the git@github.com:ansible/ansible.git checkout URL.

ansible_switch() {
	local version=${1:-}
	local srcpath="${PWD}"
	test -d ~/git || mkdir ~/git ; cd ~/git
	if [[ ! -d ansible_${version} ]] ; then
		git clone -b stable-${version} --recursive https://github.com/ansible/ansible.git ansible_${version}
	fi
	git pull ansible_${version}
	export MANPATH="${MANPATH//$HOME\/git\/ansible_?.?\/docs\/man:/}"
	export PYTHONPATH="${PYTHONPATH//$HOME\/git\/ansible_?.?\/lib:/}"
	export PATH="${PATH//$HOME\/git\/ansible_?.?\/bin:/}"
	source ansible_${version}/hacking/env-setup
	cd "${srcpath}"
}

ansible_switch() {

local version=${1:-}

local srcpath="${PWD}"

test -d ~/git || mkdir ~/git ; cd ~/git

if [[ ! -d ansible_${version} ]] ; then

git clone -b stable-${version} --recursive https://github.com/ansible/ansible.git ansible_${version}

git pull ansible_${version}

export MANPATH="${MANPATH//$HOME\/git\/ansible_?.?\/docs\/man:/}"

export PYTHONPATH="${PYTHONPATH//$HOME\/git\/ansible_?.?\/lib:/}"

export PATH="${PATH//$HOME\/git\/ansible_?.?\/bin:/}"

source ansible_${version}/hacking/env-setup

cd "${srcpath}"

}

Ansible tasks to reboot a server if required

June 23, 2016Ryanansible

A quick one today. The following ansible tasks check if a server needs to be rebooted, reboots it, and then waits for it to come back online. Easy to fire off during a maintenance after updating packages.

- name: reboot server if /var/run/reboot-required exists
  command: shutdown -r now
  args:
    removes: /var/run/reboot-required

- name: wait until rebooted
  local_action: wait_for host={{ inventory_hostname }} port=22 state=started delay=30

- name: give sshd a few seconds to start up fully
  raw: echo ssh subsystem online
  register: result
  until: result.stdout.find("ssh subsystem online") != -1
  retries: 50
  delay: 10

- name: reboot server if /var/run/reboot-required exists

command: shutdown -r now

args:

removes: /var/run/reboot-required

- name: wait until rebooted

local_action: wait_for host={{ inventory_hostname }} port=22 state=started delay=30

- name: give sshd a few seconds to start up fully

raw: echo ssh subsystem online

until: result.stdout.find("ssh subsystem online") != -1

retries: 50

delay: 10