Ansible 101 - Episode 9 - First 5 min server security with Ansible

แชร์
ฝัง
  • เผยแพร่เมื่อ 20 ธ.ค. 2024

ความคิดเห็น • 42

  • @rtomimbang
    @rtomimbang 4 ปีที่แล้ว +7

    Thank you Jeff for this wonderful series I am re-watching all videos to help me fully use the technology to the fullest.

  • @jackstl
    @jackstl 3 ปีที่แล้ว +2

    I just discovered your channel while searching for Raspberry Pi projects. I'm now working my way through your Ansible series. It is good to see a fellow St. Louisan that loves tech. Keep up the good work.

  • @etamminga
    @etamminga 2 ปีที่แล้ว +2

    Cool to see you being proud for 10k/20k subscibers ;) You're at 274k while I'm watching this, so cool.

  • @mankala8
    @mankala8 7 หลายเดือนก่อน +3

    And now, >700k subscribers, hopefully soon to be a million.

    • @JeffGeerling
      @JeffGeerling  7 หลายเดือนก่อน

      Haha, that'd be pretty crazy! Who would've thought...

    • @mankala8
      @mankala8 7 หลายเดือนก่อน

      @@JeffGeerling Right? As just a consumer of youtube content, I tend to assume that anyone who makes it to me through the algorithm must be big. I've been watching your videos occasionally when they come up and are about topics I find interesting for maybe a year? So it's crazy to see that just four years ago you had so few subscribers.
      It must be even more crazy for you, though I imagine very validating!

    • @JeffGeerling
      @JeffGeerling  7 หลายเดือนก่อน

      @@mankala8 Heh, definitely. It changed my career, and the inflection point was really this Ansible 101 series!

  • @wekiwa7055
    @wekiwa7055 3 ปีที่แล้ว +3

    Phenomenal presentation Jeff! I'm watching this series many times!

  • @thevivariumforhalfmeasures7698
    @thevivariumforhalfmeasures7698 5 หลายเดือนก่อน

    42:50 sometimes it can be useful to add `backup` to the task to create a timestamped backup of the file just in case.

  • @hotrodhunk7389
    @hotrodhunk7389 ปีที่แล้ว

    Thank you so much. There's a lot to ansible but the way you lay it out it's manageable. And now that i see the power of it it's a very powerful tool

  • @joseph9915
    @joseph9915 3 ปีที่แล้ว +1

    Never heard of Big wheel for people in charge. But have heard similar to the following quote from the cambridge online dictionary for someone taking control, even outside driving.
    "Would you mind taking the wheel (= driving) for a couple of hours?" Only what I remember was "why don't you take the wheel" when playing games ages ago.
    From uk.

  • @drk_blood
    @drk_blood ปีที่แล้ว

    Look at ya now... 500k+ subs.
    Well done mate :)

  • @kuhluhOG
    @kuhluhOG ปีที่แล้ว +1

    22:10 Imo a better idea is to only expose ssh to your internal network and not the web.
    Sure, they can still notice the open port if they hack an internal device, but they can't get in that way from the outside.

    • @zombie_pigdragon
      @zombie_pigdragon ปีที่แล้ว

      This is true, but the two rules aren't mutually exclusive. Setting SSH to a non-standard port for private devices is good, and not allowing internal devices to be externally accessed is essential.

  • @DuarteVasconcelos71
    @DuarteVasconcelos71 ปีที่แล้ว

    Portugal. keep the great videos

  • @milenkomarkovic
    @milenkomarkovic ปีที่แล้ว

    Really nice work.

  • @kuhluhOG
    @kuhluhOG ปีที่แล้ว

    47:27 personally I just go, create a user for the webserver and chown the directory to that user and "other" has permission 0

  • @declanmcardle
    @declanmcardle 3 ปีที่แล้ว

    @45:00 name: - log4j state: absent

  • @deefdragon
    @deefdragon 4 ปีที่แล้ว +3

    two requests. Please put Ansible 101 into it's own playlist, and please order the playlists in reverse to the way the currently are (at-least the ansible one anyway) as the TH-cam playlist player plays them in reverse order currently.

    • @JeffGeerling
      @JeffGeerling  4 ปีที่แล้ว +5

      Done! Here's a new Ansible 101 playlist: th-cam.com/play/PL2_OBreMn7FqZkvMYt6ATmgC0KAGGJNAN.html (still getting the hang of how to best manage my playlists!).

  • @klmcwhirter
    @klmcwhirter 4 ปีที่แล้ว

    When adding a task like your yum-cron install - do you typically use a when: ansible_os_family == 'Redhat' ? Or not?

  • @EsronDtamar
    @EsronDtamar 3 ปีที่แล้ว +2

    What about the DevOps guitar solo now that you have 118k subs?

  • @declanmcardle
    @declanmcardle 3 ปีที่แล้ว

    @59:50 ec2 user-data and a bit of sed should sort you out...

  • @anthonyrussano
    @anthonyrussano 3 ปีที่แล้ว +1

    I demand the Kubernetes Song!!!

  • @kevinadams2827
    @kevinadams2827 4 ปีที่แล้ว

    HI Jeff,
    Thanks for the videos. I am going to assume that you issued EC2 Inbound Policies for ports 22 and 2849 beforehand? Just trying to ease my mind.

    • @JeffGeerling
      @JeffGeerling  4 ปีที่แล้ว

      Kevin Adams ya! In this case, I opened up all ports to the world in this instance's security group :)

    • @kevinadams2827
      @kevinadams2827 4 ปีที่แล้ว

      @@JeffGeerling Actually looking at this a bit more, it looks like it would be possible to use Ansible to add the security group to AWS for the deletion and addition of ports 22 and 2849 for the VPC in question. This is becoming very powerful the more I research and use it. Again, thanks for your videos.

  • @yoyoheisenberg
    @yoyoheisenberg 4 ปีที่แล้ว

    Hi Jeff
    Will you not be covering Chapter 7 and Chapter 8?
    I was really looking forward to Dynamic inventories and the Ansible cookbooks.

    • @JeffGeerling
      @JeffGeerling  4 ปีที่แล้ว +1

      The full schedule is a little bit in flux, and after the first few chapters I've switched up the order just to make for a better video series. I will likely cover at least dynamic inventories, but haven't decided what else in the book I will be able to cover before I finish off this particular series.

    • @yoyoheisenberg
      @yoyoheisenberg 4 ปีที่แล้ว

      Okay. Thank you for the video series as well as the book. It would be really helpful if you could include a short session on dynamic inventories in one of your sessions.
      Also, I had a question regarding "Ansible for Kubernetes". For someone who doesn't have working knowledge of Kubernetes, will they be able to follow-up on Ansible for Kubernetes book of yours.

    • @JeffGeerling
      @JeffGeerling  4 ปีที่แล้ว

      @@yoyoheisenberg I hope to do a follow-up series on Ansible for Kubernetes, or at least Kubernetes 101 + some level of Ansible automation integration; we'll see!

  • @pepeshopping
    @pepeshopping 4 ปีที่แล้ว +1

    $1000/mo for doing this?
    If you don’t do it for the love of it....
    It shows and comes across. Some people don’t mind, some mind a lot.

    • @JeffGeerling
      @JeffGeerling  4 ปีที่แล้ว +8

      Ha! If only; I do this and will continue doing it for love of open source (my whole career has been focused around different open source software platforms). But I would like to be able to increase the number of hours per week I can devote to these things, and offer more to the community.
      At my target, I'd be able to acquire better equipment for better (and likely more frequent) videos, and do more work to review PRs and such by dedicating hours I *normally* have to devote to paid client work in a given week.
      To be honest, I budget $0 out of any of my open source work, and have been getting nothing in return for years-and I don't complain about it. Open source funding is impossibly hard. But if I can make it possible to do open source development full time someday, I'd love to make that happen.
      On the flip side, if you're not doing any real, practical implementation work (e.g. client work), then you can lose touch with what kind of open source work is effective and actually helpful/realistic. Case in point: most of the demo-style blog posts and videos you see on TH-cam where it's obvious someone just barely got the basics in place and then throws you to the wolves. Like "Here's how to draw an owl. Draw a circle... then the rest of the owl!"

    • @JeffGeerling
      @JeffGeerling  4 ปีที่แล้ว +1

      @bodzio4062 - To be fair, the electricity for a Pi cluster is like $0.20/month here in the midwest :D

    • @adamolsson1036
      @adamolsson1036 4 ปีที่แล้ว +3

      I don't see how anyone can blame Jeff for being too focused on money, while he is literally giving away free video lectures on the book he has written.
      Really loving the content, thanks so much Jeff!

    • @cxgslegend01
      @cxgslegend01 4 ปีที่แล้ว

      Ah yes, the old every open-source dev should be poor and hungry argument. I don't know where this mindset came from. Open source devs need money too. In fact, I believe this is the reason many open-source projects never get any traction and die. Its because the people who use open-source software don't support it. They spend all their money buying Microsoft licenses and paying Amazon for EC2 etc... Then they can't figure out why open source projects keep dying, with proprietory projects replacing them. It's very simple, its because you spend all your money on proprietary software, and then yell at open-source devs for daring to make a little money.
      If you don't have money to support him, then thats fine. But stop acting like he is doing something wrong.

  • @KimJersin
    @KimJersin ปีที่แล้ว

    Regarding file mode. Why not use the symbolic mode of chmod..
    Ie. your "0644" becomdes "u=rw,go=r"
    Great videos and great book.
    /Kim - Denmark