ansible-initial-server

Initial configuration of a freshly installed Debian/Ubuntu or OpenBSD server to be used as a template in KVM.

• use the latest Github tagged version which has been tested more thoroughly than 'master'

Requirements

Install from ISO (or use packer-proxmox-templates)

• this role is used by packer-proxmox-templates

Use with a default install of Debian 10 net-install ISO

• installed from debian-10.x.y-amd64-netinst.iso
• include ssh server
• an auto-install 'preseed.cfg' file can be used to speed-up the initial install

Use with a default install of Ubuntu 18.04 server ISO

• installed from ubuntu-18.04.x-server-amd64.iso (not live-server!)
• Software: Standard System Utilities and SSH Server (Standard and Server in Ubuntu)
• Default user deploy (customizable)
• Partitions: 1 primary ext4 root partition /dev/sda1 (no swap); Grub on MBR
• an auto-install 'preseed.cfg' file can be used to speed-up the initial install

Use with a default install of Ubuntu 20.04 server ISO

• installed from ubuntu-20.04.x-legacy-server-amd64.iso (not live-server!)
• Software: Standard System Utilities and SSH Server (Standard and Server in Ubuntu)
• Default user deploy (customizable)
• Partitions: 1 primary ext4 root partition /dev/sda1 (no swap); Grub on MBR
• an auto-install 'preseed.cfg' file can be used to speed-up the initial install

Use with a default install of OpenBSD 6.x server ISO

• installed from install6x.iso
• installed with all file sets (or drop optional -comp* -game* -x*)
• requires python to be installed first
• an auto-install 'install.conf' file can be used to speed-up the initial install

Use with a default install of Alpine 3.x server ISO

• installed from alpine-virt-3.x.y-x86_64.iso
• an auto-install 'answers' file can be used to speed-up the initial install

Configuration features - Debian/Ubuntu

• qemu-guest-agent for Packer SSH and in Proxmox for shutdown and backups
• haveged random number generator to speed up boot
• passwordless sudo for default user 'deploy' (name can be changed)
• SSH public key installed for default user with only key login permitted
• no login for root (optional)
• display IP and SSH fingerprint before console login
• serial console
• generates new SSH host keys on first boot to avoid duplicates in cloned VMs
• automatically grow partition after resizing VM disk
• optional SSH warning banner
• optional Verse of the Day displayed on motd

Configuration features - Alpine

• qemu-guest-agent for Packer SSH and in Proxmox for shutdown and backups
• passwordless sudo for default user 'deploy' (name can be changed)
• SSH public key installed for default user with only key login permitted
• no login for root (optional)
• display IP and SSH fingerprint before console login
• serial console
• generates new SSH host keys on first boot to avoid duplicates in cloned VMs
• automatically grow partition after resizing VM disk
• optional SSH warning banner

Configuration features - OpenBSD

• passwordless doas for default user 'deploy' (name can be changed)
• SSH public key installed for default user with only key login permitted
• no login for root (optional)
• display IP and SSH fingerprint before console login
• serial console
• generates new SSH host keys on first boot to avoid duplicates in cloned VMs
• optional SSH warning banner

Vanilla

Running the role with the vanilla tag will only make minimal modifications to the system:

• passwordless sudo/doas for default user 'deploy' (name can be changed)
• SSH public key installed for default user with only key login permitted
• no login for root
• serial console
• no change to repositories
• set hostname and /etc/hosts
• set timezone
• no customization to motd, bashrc, etc.
• will not disable Ubuntu swapfile
• will not display IP and SSH fingerprint before console login
• will not automatically grow partition after resizing VM disk
• check tasks/main.yml and other task files to see what else is excluded

After Installation from ISO

• check networking, that the VM is reachable via SSH

Important Role Variables

iserver_user - Username of the default user

iserver_[OS]_repos - List of repositories which will replace the initial defaults

iserver_[OS]_packages - List of system utilities to install

iserver_hostname and iserver_domain - Hostname and domain name

iserver_sshkey - SSH-key of the default user

Important Flags

iserver_is_a_vm - set to False when using the role on bare metal server

iserver_lock_root - set to True in order to disallow root login even on console

iserver_static_ip - set to True if configuring a static IP

iserver_verse_enabled - show a Verse of the Day on motd

Tags

vanilla - only make minimal modifications

is_template - include additional tasks useful for Proxmox templates

travis - these tasks will be skipped in Travis testing

proxmox - these tasks are only intended for Proxmox and should be skipped on a VPS (--skip-tags "proxmox")

• Check which tasks are going to be executed (example)

ansible-playbook -v server-template.yml --tags "vanilla,is_template" --skip-tags "openbsd,alpine" --list-tasks

Example Playbook

Name of playbook: server-template.yml

• make sure the correct username is used, which is the default user name set up during iso installation

- name: Initial configuration of a server.
  hosts: servers
  user: deploy
  vars_files:
    - server-template-vars.yml
  roles:
    - role: ansible-initial-server
      vars:
        iserver_user: deploy

The Debian installer by default creates a root user with a root password, who is not permitted to SSH in to the server. Sudo is not installed by default. Therefore the default user can SSH into Debian, but has to use su to do roots tasks. There is no need to change sshd_config to PermitRootLogin yes, because this Ansible role can authenticate with the initial user password and then 'become' root using 'su'.

For the first run on Debian (before sudo is active & the SSH key has been transferred):

• ansible-playbook --ask-pass --ask-become-pass -e iserver_become=su -v server-template.yml

For the first run on Ubuntu (before the SSH key has been transferred):

• ansible-playbook --ask-pass --ask-become-pass -v server-template.yml

For the first run on Alpine (as root before the SSH key has been transferred):

• ansible-playbook --ask-pass -v server-template.yml

For subsequent runs or on installations which have sudo/doas and SSH-key already enabled:

• ansible-playbook -v server-template.yml

License

MIT

Author Information

Christian Wagner