This guide will show you how to automate the initial OpenBSD 7 server configuration with Ansible. Ansible is a software tool that automates the configuration of one or more remote nodes from a local control node. The local node can be another Linux system, a Mac, or a Windows PC. If you are using a Windows PC, you can install Linux using the Windows Subsystem for Linux. This guide will focus on using a Mac as the control node to set up a fresh Vultr OpenBSD 7 server.
The OpenBSD 7 Ansible setup playbook is listed at the end of this guide. In addition, instructions are provided on how to install and use it.
It takes a little work to set up and start using Ansible, but once it is set up and you become familiar with it, using Ansible will save a lot of time and effort. For example, you may want to experiment with different applications. Using the Ansible setup playbook described in this guide, you can quickly reinstall your OpenBSD 7 instance and then run the playbook to configure your base server. This playbook is a good base for installing web servers, database servers, or email server.
We will use a single Ansible playbook that will do the following:
Apply all the available OpenBSD system patches.
Upgrade the installed OpenBSD packages.
Reboot the server if needed and wait for it to become active.
Install a base set of useful software packages.
Set a fully qualified domain name (FQDN).
Set the timezone.
Set the SSH port number.
Disable SSH password authentication for root.
Disable tunneled clear-text passwords.
Configure /etc/doas.conf.
Create regular user group.
Create a regular user with doas privileges.
Install SSH Keys for the regular user.
Ensure authorized key for root user is installed.
Update/Change the root password.
Create a .vimrc resource file that disables vi visual mode for root and the user.
Create a 2-line prompt and bash ls aliases for the user.
Create ksh ls aliases for root.
Configure the OpenBSD PF firewall.
Packet Filter (PF) is the OpenBSD system for creating a network firewall and for doing Network Address Translation. In this guide, we will show how to use PF to create a basic firewall. Refer to the OpenBSD PF User's Guide for more details. The PF configuration also provides brute force protection for SSH. It will ban host IPs that try to make five or more SSH connection attempts within a three-second interval.
OpenBSD uses ksh as the default shell for both root and regular users. This ansible playbook will install the bash shell and configure it for the regular user. The root user continues to use the OpenBSD ksh environment.
A Vultr server with a freshly installed OpenBSD 7.0 instance.
A local Mac, Windows with WSL, or Linux system. This guide focuses on Mac, but the procedures are similar for any Linux control node.
If using a Mac, Homebrew should be installed.
A previously generated SSH Key for the Vultr host, and the SSH public key should be installed for the root user.
Ansible 2.9.x, or later stable version. This guide is tested with Ansible version 2.9.27 on a Mac, installed via Homebrew.
For this guide, we are using the Ansible 2.9.x Red Hat released version.
Using a Mac with Homebrew installed:
$ brew install [email protected]
$ brew link --force --overwrite [email protected]
This will install Ansible along with all the required dependencies, including python version 3.9.x. You can quickly test you your installation by doing:
$ ansible --version
ansible 2.9.27
config file = /Users/george/.ansible.cfg
configured module search path = ['/Users/george/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/local/Cellar/[email protected]/2.9.27_2/libexec/lib/python3.9/site-packages/ansible
executable location = /usr/local/bin/ansible
python version = 3.9.10 (main, Jan 15 2022, 11:48:00) [Clang 13.0.0 (clang-1300.0.29.3)]
Create the .ansible.cfg configuration file in the user home directory. This tells Ansible how to locate the host's inventory file.
Add the following content to ~/.ansible.cfg:
[defaults]
inventory = /Users/user/ansible/hosts.yml
interpreter_python = auto
Be sure to replace user with your actual user name.
Create the folder to store the hosts.yml hosts inventory file:
$ mkdir ~/ansible
$ cd ~/ansible
Of course, you can put it anywhere you want to and give it any name. Just make sure that your .ansible.cfg file points to the correct location.
Add the following content to ~/ansible/hosts.yml:
all:
vars:
ansible_python_interpreter: /usr/bin/python3
ansible_become: yes
ansible_become_method: sudo
children:
vultr:
hosts:
host.example.com:
user: user
user_passwd: "{{ host_user_passwd }}"
root_passwd: "{{ host_root_passwd }}"
ssh_pub_key: "{{ lookup('file', '~/.ssh/host_ed25519.pub') }}"
ansible_become_pass: "{{ host_user_passwd }}"
ansible_python_interpreter: /usr/local/bin/python3
vmware:
hosts:
debian1.local:
user: george
user_passwd: "{{ db1_user_passwd }}"
root_passwd: "{{ db1_root_passwd }}"
ssh_pub_key: "{{ lookup('file', '~/.ssh/db1_ed25519.pub') }}"
ansible_become_pass: "{{ db1_user_passwd }}"
The first block defines ansible variables that are global to the host's inventory file. Hosts are listed under children groups.
Replace host with your actual host name. The vmware group shows a working example for setting up a VMware host on my Mac.
The user is the regular user to be created. The host_user_passwd and host_root_passwd are the user and root passwords that are stored in an ansible vault, described below. ssh_pub_key points to the SSH public key for the Vultr host. The ansible_become lines provide the ability for the newly created user to execute doas commands in future ansible playbooks.
The python3 executable location is different for OpenBSD, so the "child" ansible_python_interpreter defines the OpenBSD python3 location.
Create the directory for the Ansible password vault and set-up playbook:
$ mkdir -p ~/ansible/openbsd
$ cd ~/ansible/openbsd
Create the Ansible password vault:
$ ansible-vault create passwd.yml
New Vault password:
Confirm New Vault password:
This will start up your default system editor. Add the following content:
host_user_passwd: ELqZ9L70SSOTjnE0Jq
host_root_passwd: tgM2Q5h8WCeibIdJtd
Replace host with your actual hostname. Generate your own secure passwords. Save and exit your editor. This creates an encrypted file that only Ansible can read. You can add other host passwords to the same file.
pwgen is a very handy tool that you can use to generate secure passwords. Install it on a Mac via Homebrew: brew install pwgen. Use it as follows:
$ pwgen -s 18 2
ELqZ9L70SSOTjnE0Jq tgM2Q5h8WCeibIdJtd
You can view the contents of the ansible-vault file with:
$ ansible-vault view passwd.yml
Vault password:
You can edit the the file with:
$ ansible-vault edit passwd.yml
Vault password:
Next, we need to define the Vultr hostname and SSH port number that Ansible will use to connect to the remote host.
The SSH configuration for the server host is stored in ~/.ssh/config. An example configuration on a Mac looks like:
Host *
AddKeysToAgent yes
UseKeychain yes
IdentitiesOnly yes
AddressFamily inet
Host host.example.com host
Hostname host.example.com
Port 22
User user
IdentityFile ~/.ssh/host_ed25519
Using the SSH config file, you can change the default SSH port number if changed by the ansible playbook. The playbook is always executed the first time with SSH port 22. If the SSH port number is changed by the playbook, then the SSH port number in the SSH config file needs to be changed after the playbook runs.
With this SSH configuration file, you can use a shorthand host name to log into the server.
For the user login:
$ ssh host
For the root login:
$ ssh root@host
UserKeychain is specific to macOS. It stores the SSH public key in the macOS key chain.
host.example.com is your Vultr server FQDN (Fully Qualified Domain Name) that needs to be defined in your DNS or /etc/hosts file on your local system. Port 22 is optional, but required if you define a non-standard SSH port.
Important: Install your SSH Key for the root user if you have not done so already:
$ ssh-copy-id -i ~/.ssh/host_ed25519 root@host
and verify that you can login without using a password.
Note: If you reinstall your Vultr instance, be sure to delete your Vultr hostname from ~/.ssh/known_hosts on your local control node. Otherwise, you will see an SSH error when you try to log into your reinstalled host. The hostname is added to this file the during the first login attempt:
$ ssh root@ap1
The authenticity of host 'np1.example.com (216.128.149.25)' can't be established.
ECDSA key fingerprint is SHA256:oNczYD+xuXx0L6CM17Ciy+DWu3jOEbfVclIj9wUT7Y8.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Answer yes to the question. If you don't delete the hostname from this file after reinstalling your instance, you will see an error like:
$ ssh root@ap1
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
o o o
If this happens, just delete the line entered for your hostname in the known_hosts file and run the ssh command again.
Before trying to run the setup ansible playbook, we need to verify that Ansible is working correctly, that you can access your Ansible vault, and connect to your Vultr host. First, verify that Ansible is installed correctly on a Mac:
$ ansible --version
ansible 2.9.27
config file = /Users/user/.ansible.cfg
o o o
This is the latest versions of Ansible on a Mac/Homebrew when this guide was written.
Run this command to test your Ansible configuration (also, your SSH configuration):
$ cd ~/ansible/openbsd
$ ansible -m ping --ask-vault-pass --extra-vars '@passwd.yml' host.example.com -u root
Vault password:
host.example.com | SUCCESS => {
"changed": false,
"ping": "pong"
}
If you see the above output, then everything is working fine. If not, go back and double-check all your SSH and Ansible configuration settings. Start by verifying that you can execute:
$ ssh root@host
and login in without a password, because you have installed your SSH key for root.
Note: See Section 6. OpenBSD 7.0 PF and Ansible Setup Playbook Listings for the PF and playbook file listing details.
Copy and paste the Ansible PF configuration file into ~/ansible/openbsd/templates/etc/pf.conf.j2.
Copy and paste the OpenBSD setup playbook into ~/ansible/openbsd/setup-pb.yml.
You are ready to run the playbook. When you execute the playbook, you will be prompted for your vault password. The playbook will execute a number of tasks with a PLAY RECAP at the end. You can rerun the playbook multiple times; for example, you may want to change the SSH port number. It will only execute tasks when needed. Be sure to update variables at the beginning of the playbook, such as your SSH port number and your timezone.
Be sure that you are in the ~/ansible/openbsd directory. This is the command to run:
$ ansible-playbook --ask-vault-pass --extra-vars '@passwd.yml' setup-pb.yml -l host.example.com -u root
Vault password:
Depending on the speed of your Mac, it make take a few seconds to start up. If it completes successfully, you will see PLAY RECAP like:
PLAY RECAP *************************************************************************************************************************
np1.nimbusplace.com : ok=38 changed=27 unreachable=0 failed=0 skipped=5 rescued=0 ignored=0
The most important thing to note is that there should be no failed tasks.
Next, are some basic tests that you can run to verify your server setup.
After you have successfully executed the Ansible setup playbook, here are some basic tests that you can execute to verify your sever setup. Here are some real-life examples with the server host that was used to test the setup playbook (the hostname is np1.nimbusplace.com and the user name is george).
Verify that you can log into your new user account using your host's public SSH key:
â•â”€george@imac1 ~/ansible/openbsd
╰─$ ssh np1
Last login: Tue Feb 8 11:38:49 2022 from 72.34.15.207
OpenBSD 7.0 (GENERIC.MP) #5: Mon Jan 31 09:09:02 MST 2022
Welcome to OpenBSD: The proactively secure Unix-like operating system.
Please use the sendbug(1) utility to report bugs in the system.
Before reporting a bug, please try to reproduce it with the latest
version of the code. With bug reports, please try to ensure that
enough information to reproduce the problem is enclosed, and if a
known fix for it exists, include that as well.
george@np1:~
$
Note the two-line prompt. The first line shows user@host and the current directory.
Now, note how the l, la, and ls LS aliases work and the presence of the .vimrc file:
george@np1:~
$ touch tmpfile
george@np1:~
$ l
tmpfile
george@np1:~
$ la
.Xdefaults .bashrc .cvsrc .mailrc .ssh/ tmpfile
.bash_history .cshrc .login .profile .vimrc
george@np1:~
$ ll
total 48
drwxr-xr-x 3 george george 512 Feb 17 14:04 ./
drwxr-xr-x 3 root wheel 512 Feb 17 13:17 ../
-rw-r--r-- 1 george george 87 Sep 30 15:00 .Xdefaults
-rw------- 1 george george 5 Feb 17 13:25 .bash_history
-rw-r--r-- 1 george george 54 Feb 17 13:17 .bashrc
-rw-r--r-- 1 george george 769 Sep 30 15:00 .cshrc
-rw-r--r-- 1 george george 101 Sep 30 15:00 .cvsrc
-rw-r--r-- 1 george george 359 Sep 30 15:00 .login
-rw-r--r-- 1 george george 175 Sep 30 15:00 .mailrc
-rw-r--r-- 1 george george 388 Feb 17 13:17 .profile
drwx------ 2 george george 512 Feb 17 13:17 .ssh/
-rw-r--r-- 1 george george 13 Feb 17 13:17 .vimrc
-rw-r--r-- 1 george george 0 Feb 17 14:04 tmpfile
george@np1:~
$ cat .vimrc
set mouse-=a
The .vimrc set mouse-=a option turns off the VI visual mode, which makes it possible to use your mouse to select and copy a block of text in a VI window.
You can still login to the root account via the host SSH key. Logging in via SSH using a password is disabled. You can still login as root with a password when using the Vultr VNC console.
$ ssh root@np1
Last login: Thu Feb 17 14:50:42 2022
OpenBSD 7.0 (GENERIC.MP) #5: Mon Jan 31 09:09:02 MST 2022
o o o
np1#
The default root environment still uses ksh. The only changes were to add the l and ll LS aliases and the .vimrc VI configuration file:
np1# l
.Xdefaults .bash_history .cvsrc .login .ssh/
.ansible/ .cshrc .kshrc .profile .vimrc
np1# ll
total 48
drwx------ 4 root wheel 512 Feb 17 14:12 ./
drwxr-xr-x 13 root wheel 512 Feb 17 13:16 ../
-rw-r--r-- 1 root wheel 87 Sep 30 15:00 .Xdefaults
drwx------ 3 root wheel 512 Feb 17 13:15 .ansible/
-rw------- 1 root wheel 14 Feb 17 14:13 .bash_history
-rw-r--r-- 1 root wheel 578 Sep 30 15:00 .cshrc
-rw-r--r-- 1 root wheel 94 Sep 30 15:00 .cvsrc
-rw-r--r-- 1 root wheel 36 Feb 17 13:17 .kshrc
-rw-r--r-- 1 root wheel 328 Sep 30 15:00 .login
-rw-r--r-- 1 root wheel 611 Feb 17 13:17 .profile
drwx------ 2 root wheel 512 Feb 7 23:28 .ssh/
-rw-r--r-- 1 root wheel 13 Feb 17 13:17 .vimrc
np1# cat .vimrc
set mouse-=a
Even though you use an SSH public key to login to your user account, you still need to use your user password with the doas command. For example, use the doas command to change to the root account (enter your user password when prompted):
george@np1:~
$ doas -s
doas ([email protected]) password:
bash-5.1# pwd
/home/george
bash-5.1# exit
exit
While in your user account, you can also use su - to change to the root account. One difference is that you will have to enter your root password:
george@np1:~
$ su -
Password:
np1#
While we are in the root account, lets verify our hostname and some other features that the playbook set up for us:
np1# hostname -s
np1
np1# hostname
np1.nimbusplace.com
np1# date
Thu Feb 17 14:18:21 CST 2022
Here we verified both the short and FQDN host names. With the date command, verify that the timezone is set correctly.
A complete discussion of PF is beyond the scope of this guide, but here are some examples to start with.
To see the current installed PF rule set:
george@np1:~
$ doas pfctl -sr
doas ([email protected]) password:
match in all scrub (no-df random-id max-mss 1440)
block drop in quick on ! egress inet from 66.42.112.0/23 to any
block drop in quick on ! egress inet6 from 2001:19f0:5c01:1a41::/64 to any
block drop in quick on vio0 inet6 from fe80::5400:3ff:fed4:1b5c to any
block drop in quick inet6 from 2001:19f0:5c01:1a41:5400:3ff:fed4:1b5c to any
block drop in quick on ! vio0 inet6 from 2001:19f0:5c01:1a41::/64 to any
block drop in quick inet from 66.42.112.216 to any
block drop in quick on ! vio0 inet from 66.42.112.0/23 to any
block return quick from <bruteforce> to any
block return in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block return all
pass in log on vio0 proto tcp from any to any port = 22 flags S/SA keep state (source-track rule, max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush global, src.track 3) label "ssh-traffic"
pass out quick all flags S/SA
pass in on egress inet6 proto ipv6-icmp all icmp6-type echoreq
pass in on egress inet6 proto ipv6-icmp all icmp6-type unreach
pass in on egress inet6 proto ipv6-icmp all icmp6-type routeradv
pass in on egress inet6 proto ipv6-icmp all icmp6-type neighbrsol
pass in on egress inet6 proto ipv6-icmp all icmp6-type neighbradv
pass in on egress inet proto icmp all icmp-type echoreq
pass in on egress inet proto icmp all icmp-type unreach
To see the contents of the martians PF table:
george@np1:~
$ doas pfctl -t martians -Ts
0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.88.99.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/3
255.255.255.255
::/96
::1
::ffff:0.0.0.0/96
100::/64
2001:2::/48
2001:10::/28
2001:db8::/32
3ffe::/16
fc00::/7
fec0::/10
To see the contents of the SSH bruteforce table:
george@np1:~
$ doas pfctl -t bruteforce -Ts
12.34.56.78
These are hosts that have made multiple SSH connection attempts in a short interval. You can test that it's working by trying to rapidly log into your host multiple times with an invalid password and no SSH key. Be careful to not lock yourself out.
If you accidentally lock yourself out:
george@imac1:~/ansible/openbsd
$ ssh np1
ssh: connect to host np1.nimbusplace.com port 22: Connection refused
Log into your OpenBSD host as root via the Vultr VNC Console and execute:
np1# pfctl -t bruteforce -T delete 12.34.56.78
1/1 addresses deleted.
Then you will be able to SSH into your host.
Here are the listings for the PF configuration file and the Ansible setup playbook.
This PF configuration will create a basic firewall that allows SSH and ICMP traffic. All other external traffic is blocked. Internal traffic is allowed.
Create the Ansible PF configuration file directory:
mkdir -p ~/ansible/openbsd/templates/etc
Create the Ansible PF configuration file:
cd ~/ansible/openbsd/templates/etc
and add the following to pf.conf.j2:
wan0 = "{{ ansible_default_ipv4.interface }}"
icmp_types = "{ echoreq unreach }"
# pfctl -t "table" -T show
# Display table contents.
# pfctl -t bruteforce -T expire 86400
# Remove bruteforce table entries older than 86400 seconds.
# pfctl -t bruteforce -T delete 12.34.56.78
# Immediately delete bruteforce table entry
table <bruteforce> persist
table <martians> {
0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 \
127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 \
192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 224.0.0.0/3 255.255.255.255/32 \
::/128 ::/96 ::1/128 ::ffff:0:0/96 100::/64 \
2001:10::/28 2001:2::/48 2001:db8::/32 \
3ffe::/16 fec0::/10 fc00::/7 }
set block-policy return
set loginterface egress
set skip on lo0
match in all scrub (no-df random-id max-mss 1440)
antispoof quick for { egress $wan0 }
block quick from <bruteforce>
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block all
# SSH
# Add brute force hosts (5 attempts within 3 seconds)
# to the bruteforce table.
pass in log on $wan0 proto tcp to port { {{ ssh_port }} } \
keep state (max-src-conn 15, max-src-conn-rate 5/3, \
overload <bruteforce> flush global) label ssh-traffic
pass out quick
# ICMP
pass in on egress inet proto icmp all icmp-type $icmp_types
pass in on egress inet6 proto icmp6 all icmp6-type $icmp_types
pass in on egress inet6 proto icmp6 all \
icmp6-type { routeradv neighbrsol neighbradv }
cd ~/ansible/openbsd
and add the following to setup-pb.yml:
# Initial server setup
#
---
- hosts: all
become: true
vars:
ssh_port: "22"
tmzone: America/Chicago
user_shell: /usr/local/bin/bash
doas: |
permit persist :wheel
vimrc: |
set mouse-=a
dot_profile: |
export PATH HOME TERM
# This is the standard OpenBSD PATH,
# defined for easy customization.
PATH=/bin:/sbin:/usr/bin:/usr/sbin
PATH=$PATH:/usr/X11R6/bin
PATH=$PATH:/usr/local/bin:/usr/local/sbin
PATH=$PATH:/usr/games
PATH=$HOME/bin:$PATH
# include .bashrc if it exists
if [ -f "$HOME/.bashrc" ]; then
. "$HOME/.bashrc"
fi
# Set two-line user prompt
PS1="\e[0;32m\u@\h\e[m:\w\n$ "
dot_root_profile: |
# include .kshrc if it exists
if [ -f "$HOME/.kshrc" ]; then
. "$HOME/.kshrc"
fi
dot_bashrc: |
alias l='ls -CF'
alias la='ls -AF'
alias ll='ls -alF'
dot_kshrc: |
alias l='ls -CF'
alias ll='ls -alF'
tasks:
# Update and install the base software
- name: Apply all available system patches.
command: syspatch
register: syspatch
failed_when: syspatch.rc != 0 and syspatch.rc != 2
changed_when: syspatch.rc == 0
- name: Update all packages on the system.
command: pkg_add -u
- name: Reboot the server if needed.
reboot:
msg: "Reboot initiated by Ansible because of syspatch updates."
connect_timeout: 5
reboot_timeout: 600
pre_reboot_delay: 0
post_reboot_delay: 15
test_command: whoami
when: syspatch.rc == 0
- name: Install a base set of software packages.
openbsd_pkg:
name:
- bash
- curl
- git
- htop
- pwgen
- rsync--
- vim--no_x11
state: present
# Host Setup
- name: Set static hostname.
hostname:
name: "{{ inventory_hostname }}"
- name: Add IPv4 FQDN to /etc/hosts.
lineinfile:
dest: /etc/hosts
regexp: '^127\.0\.0\.1'
line: "127.0.0.1 {{ inventory_hostname }}"
state: present
- name: Add IPv6 FQDN to /etc/hosts.
lineinfile:
dest: /etc/hosts
regexp: '^\:\:1'
line: "::1 {{ inventory_hostname }}"
state: present
- name: Add FQDN to /etc/myname.
lineinfile:
dest: /etc/myname
regexp: '^(.*)'
line: "{{ inventory_hostname }}"
state: present
- name: Set timezone.
timezone:
name: "{{ tmzone }}"
notify:
- restart cron
- name: Set ssh port port number.
lineinfile:
dest: /etc/ssh/sshd_config
regexp: 'Port '
line: 'Port {{ ssh_port }}'
state: present
notify:
- restart sshd
- name: Disable root password login via SSH.
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?PermitRootLogin'
line: 'PermitRootLogin prohibit-password'
notify:
- restart sshd
- name: Disable tunneled clear-text passwords.
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?PasswordAuthentication'
line: 'PasswordAuthentication no'
notify:
- restart sshd
- name: Configure /etc/doas.conf.
copy:
dest: /etc/doas.conf
content: "{{ doas }}"
owner: root
group: wheel
mode: 0644
- name: Create regular user group.
group:
name: "{{ user }}"
state: present
- name: Create regular user with doas privileges.
user:
name: "{{ user }}"
group: "{{ user }}"
password: "{{ user_passwd | password_hash('bcrypt') }}"
groups: wheel
append: true
shell: /usr/local/bin/bash
- name: Ensure authorized keys for remote user is installed.
authorized_key:
user: "{{ user }}"
key: "{{ ssh_pub_key }}"
- name: Ensure authorized key for root user is installed.
authorized_key:
user: root
key: "{{ ssh_pub_key }}"
- name: Update root user password.
user:
name: root
password: "{{ root_passwd | password_hash('bcrypt') }}"
- name: Configure user .vimrc.
copy:
dest: /home/{{ user }}/.vimrc
content: "{{ vimrc }}"
owner: "{{ user }}"
group: "{{ user }}"
mode: 0644
- name: Configure root .vimrc.
copy:
dest: /root/.vimrc
content: "{{ vimrc }}"
owner: root
group: wheel
mode: 0644
- name: Configure user .profile,
copy:
dest: /home/{{ user }}/.profile
content: "{{ dot_profile }}"
owner: "{{ user }}"
group: "{{ user }}"
mode: 0644
- name: Configure user .bashrc,
copy:
dest: /home/{{ user }}/.bashrc
content: "{{ dot_bashrc }}"
owner: "{{ user }}"
group: "{{ user }}"
mode: 0644
- name: Update root .profile
blockinfile:
path: /root/.profile
content: "{{ dot_root_profile }}"
owner: root
group: wheel
mode: 0644
- name: Configure root .kshrc.
copy:
dest: /root/.kshrc
content: "{{ dot_kshrc }}"
owner: root
group: wheel
mode: 0644
- name: Configure pf firewall.
template:
src: etc/pf.conf.j2
dest: /etc/pf.conf
owner: root
group: wheel
mode: 0600
notify:
- reload pf.conf
- meta: end_play
handlers:
- name: restart cron
service:
name: cron
state: restarted
- name: restart sshd
service:
name: sshd
state: restarted
- name: reload pf.conf
command: pfctl -f /etc/pf.conf
You can read the Ansible Documentation to learn more about Ansible.
You should only have to update the vars: section to change the settings for your specific situation. Most likely, you may want to update the SSH port number and timezone.
In this guide, we have introduced Ansible for automating the initial OpenBSD 7.0 server setup. This is very useful for deploying or redeploying a server after testing an application. It also creates a solid foundation for creating a web, database, or email server.