Ansible for Linux admins

Everything runs on ubu01 as student, in the folder ~/ansible. Ansible changes rocky01 and kafka01, so take snapshots of both first (VBoxManage snapshot rocky01 take before-l64 and the same for kafka01). You’ll need student’s sudo password on rocky01 and kafka01 for the steps with -K.

1Install ansible-core on ubu01

Run this:

sudo apt update
sudo apt install -y --no-install-recommends ansible-core
ansible --version

You should see something like this:

ansible [core 2.20.1]
  config file = None
  configured module search path = ['/home/student/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /home/student/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.14.3 (main, Feb  4 2026, 09:21:18) [GCC 15.2.0] (/usr/bin/python3)
  jinja version = 3.1.6
  pyyaml version = 6.0.3 (with libyaml v0.2.5)

ansible-core comes from Ubuntu’s universe repository. Without --no-install-recommends, apt would also pull in the big “ansible” package with every community collection, which you don’t need for the builtin modules. “config file = None” is normal: you’ll create one in the next step.

Python 3.14 is within what ansible-core 2.20 supports on a control node.

✅ Checkpoint: ansible --version prints core 2.20.x and Python 3.14.

2Build the project folder and the inventory

Paste this whole block:

mkdir -p ~/ansible/templates && cd ~/ansible
cat > ansible.cfg <<'EOF'
# ~/ansible/ansible.cfg  (SaatVedha Linux course, Lesson 64)
[defaults]
inventory = inventory.ini
EOF
cat > inventory.ini <<'EOF'
# ~/ansible/inventory.ini  (SaatVedha Linux course, Lesson 64)
[rocky]
rocky01 ansible_host=10.10.10.11
kafka01 ansible_host=10.10.10.31

[rocky:vars]
ansible_user=student
ansible_python_interpreter=/usr/bin/python3
EOF
ansible-inventory --graph
ansible --version | head -n 2

You should see this:

@all:
  |--@ungrouped:
  |--@rocky:
  |  |--rocky01
  |  |--kafka01
ansible [core 2.20.1]
  config file = /home/student/ansible/ansible.cfg

Ansible reads ansible.cfg from the folder you run it in, which keeps every project’s settings with the project; here it only says where the inventory is. The inventory puts both Rocky servers in a group called rocky, gives each its IP (so it works even when DNS is down), and sets two variables for the whole group: the SSH user and the Python on the hosts. Without ansible_python_interpreter, ansible-core 2.20 finds a Python by itself and prints a warning that a later Python install could change its choice.

✅ Checkpoint: ansible-inventory --graph shows rocky01 and kafka01 under @rocky, and the config file is ~/ansible/ansible.cfg.

3Load your key and ping both servers

Ansible uses your normal SSH key. Load it into the agent, accept kafka01’s host key once, then ping:

eval "$(ssh-agent -s)"; ssh-add
ssh -o StrictHostKeyChecking=accept-new student@10.10.10.31 hostname
ansible all -m ping

You should see something like this:

Agent pid 2215
Identity added: /home/student/.ssh/id_ed25519 (student@ubu01)
kafka01.saatlab.test
rocky01 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
kafka01 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

The ping module isn’t ICMP ping: it logs in over SSH, runs a tiny Python module and returns “pong”, so SUCCESS proves SSH, the key, the user and Python all work. If kafka01 says “UNREACHABLE” with “Host key verification failed”, the ssh line before it didn’t run; if it says “Permission denied (publickey)”, your key isn’t in kafka01’s authorized_keys (Lesson 58 installed it).

✅ Checkpoint: Both hosts answer “pong”.

4Run ad-hoc commands across both servers

Run these one at a time:

ansible all -a "uptime"
ansible all -m ansible.builtin.shell -a "df -h / | tail -n 1"
ansible all -a "systemctl is-active chronyd"
ansible kafka01 -b -K -m ansible.builtin.user -a "name=tempcheck state=absent"

You should see something like this:

rocky01 | CHANGED | rc=0 >>
 16:42:10 up  5:12,  2 users,  load average: 0.08, 0.05, 0.01
kafka01 | CHANGED | rc=0 >>
 16:42:10 up  3:47,  1 user,  load average: 0.41, 0.33, 0.30
rocky01 | CHANGED | rc=0 >>
/dev/mapper/rl-root   17G  3.4G   14G  20% /
kafka01 | CHANGED | rc=0 >>
/dev/mapper/rl-root   17G  2.6G   15G  16% /
rocky01 | CHANGED | rc=0 >>
active
kafka01 | CHANGED | rc=0 >>
active
BECOME password:
kafka01 | SUCCESS => {
    "changed": false,
    "name": "tempcheck",
    "state": "absent"
}

Without -m, Ansible uses the command module, which runs a program directly and doesn’t understand pipes; that’s why the df line needs the shell module. command and shell always say CHANGED, because Ansible can’t know what your command did. The last line is different: the user module checked that tempcheck doesn’t exist, found nothing to do and said SUCCESS with “changed”: false. -b (become) runs it with sudo and -K asks for the sudo password once for all hosts.

Find the modules you’ll use in the playbook, and read one manual page:

ansible-doc -l ansible.builtin | grep -E '\.(user|group|service|copy|template) '
ansible-doc ansible.builtin.user

ansible.builtin.copy                   Copy files to remote locations
ansible.builtin.group                  Add or remove groups
ansible.builtin.service                Manage services
ansible.builtin.template               Template a file out to a target host
ansible.builtin.user                   Manage user accounts

In the user page, search for append (type /append in the pager). It explains that groups without append: true replaces all of a user’s other groups, which matters in the next step. Press q to leave.

✅ Checkpoint: uptime, df and chronyd come back from both servers, and the user module reports “changed”: false for tempcheck.

5Write the playbook and its template

Still in ~/ansible, create the login message template and the playbook (paste the whole block):

cat > templates/motd.j2 <<'EOF'
{{ inventory_hostname }} ({{ ansible_facts['default_ipv4']['address'] }}) - SaatLab {{ ansible_facts['distribution'] }} {{ ansible_facts['distribution_version'] }}
Managed by Ansible from ubu01. Changes made by hand will be overwritten.
Ops contact: the saatops group
EOF
cat > baseline.yml <<'EOF'
---
# ~/ansible/baseline.yml  (SaatVedha Linux course, Lesson 64)
- name: Baseline for the SaatLab Rocky servers
  hosts: rocky
  become: true
  vars:
    ops_group: saatops
    ops_gid: 3001
    ops_users:
      - { name: kiran, uid: 3101 }
      - { name: divya, uid: 3102 }
    base_packages:
      - chrony
      - tmux
      - tree

  tasks:
    - name: Ops group exists
      ansible.builtin.group:
        name: "{{ ops_group }}"
        gid: "{{ ops_gid }}"
        state: present

    - name: Ops users exist and belong to the ops group
      ansible.builtin.user:
        name: "{{ item.name }}"
        uid: "{{ item.uid }}"
        groups: "{{ ops_group }}"
        append: true
        shell: /bin/bash
        state: present
      loop: "{{ ops_users }}"

    - name: Ops group may run read-only checks with sudo
      ansible.builtin.copy:
        dest: /etc/sudoers.d/saatops
        content: |
          # Managed by Ansible (Lesson 64). Changes made by hand will be overwritten.
          %saatops ALL=(root) /usr/bin/systemctl status *, /usr/bin/journalctl *
        owner: root
        group: root
        mode: "0440"
        validate: /usr/sbin/visudo -cf %s

    - name: Base packages are installed
      ansible.builtin.dnf:
        name: "{{ base_packages }}"
        state: present

    - name: Login message says who manages this server
      ansible.builtin.template:
        src: templates/motd.j2
        dest: /etc/motd
        owner: root
        group: root
        mode: "0644"

    - name: Time sync runs now and after every boot
      ansible.builtin.service:
        name: chronyd
        state: started
        enabled: true
EOF
ansible-playbook --syntax-check baseline.yml

You should see this:

playbook: baseline.yml

Read the playbook from the top. One play targets the rocky group with become: true. The vars section keeps the data (group name and GID, users with fixed UIDs so files keep their owners across servers, the package list) apart from the tasks, so next month you add a user by adding one line.

The sudoers task uses validate: /usr/sbin/visudo -cf %s, so Ansible checks the new file with visudo before it puts it in place and a typo can never lock you out of sudo (Lesson 16).

The template uses facts gathered from each host: ansible_facts['default_ipv4']['address'] and the distribution name and version. Every task has a name that says what the server should look like, not what to do, because that’s what you’ll read in the output.

✅ Checkpoint: --syntax-check prints “playbook: baseline.yml” with no error.

6Run the playbook

Run it with -K and type student’s sudo password once:

ansible-playbook baseline.yml -K

You should see something like this:

BECOME password: 

PLAY [Baseline for the SaatLab Rocky servers] **********************************

TASK [Gathering Facts] *********************************************************
ok: [kafka01]
ok: [rocky01]

TASK [Ops group exists] ********************************************************
changed: [rocky01]
changed: [kafka01]

TASK [Ops users exist and belong to the ops group] *****************************
changed: [rocky01] => (item={'name': 'kiran', 'uid': 3101})
changed: [kafka01] => (item={'name': 'kiran', 'uid': 3101})
changed: [rocky01] => (item={'name': 'divya', 'uid': 3102})
changed: [kafka01] => (item={'name': 'divya', 'uid': 3102})

TASK [Ops group may run read-only checks with sudo] ****************************
changed: [rocky01]
changed: [kafka01]

TASK [Base packages are installed] *********************************************
changed: [kafka01]
changed: [rocky01]

TASK [Login message says who manages this server] ******************************
changed: [rocky01]
changed: [kafka01]

TASK [Time sync runs now and after every boot] *********************************
ok: [rocky01]
ok: [kafka01]

PLAY RECAP *********************************************************************
kafka01                    : ok=7    changed=5    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
rocky01                    : ok=7    changed=5    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

Five tasks changed something on each host: the group, both users (one line per loop item), the sudoers file, the packages (tmux and tree were missing; chrony was already there) and the login message. chronyd was already running and enabled, so that task says ok. The recap is the line to read: changed=5 and failed=0 on both. Check one result by hand: ansible all -a "id kiran" should show groups=3101(kiran),3001(saatops) on both servers.

✅ Checkpoint: PLAY RECAP shows failed=0 and unreachable=0 for rocky01 and kafka01.

7Run it again and get changed=0

Run the same command again:

ansible-playbook baseline.yml -K

You should see something like this (the end of the output):

PLAY RECAP *********************************************************************
kafka01                    : ok=7    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
rocky01                    : ok=7    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

Same playbook, same servers, nothing to do: every task found its target state already in place. This is what lets you run the same playbook every night against every server, or after any manual change, as a check that nothing has drifted. A task that shows “changed” on every run is a bug to fix, usually a command or shell task that needs changed_when or a better module.

✅ Checkpoint: The second run shows changed=0 for both hosts.

8Preview a change with --check --diff, then apply it

Change one line of the template, and ask Ansible what would happen on rocky01 only:

sed -i 's/Ops contact: the saatops group/Ops contact: saatops group, extension 4417/' templates/motd.j2
ansible-playbook baseline.yml -K --check --diff --limit rocky01

You should see something like this (the end of the output):

TASK [Login message says who manages this server] ******************************
--- before: /etc/motd
+++ after: /home/student/.ansible/tmp/ansible-local-4127x8m2qv1d/tmpk3l9w0zj/motd.j2
@@ -1,3 +1,3 @@
 rocky01 (10.10.10.11) - SaatLab Rocky 10.2
 Managed by Ansible from ubu01. Changes made by hand will be overwritten.
-Ops contact: the saatops group
+Ops contact: saatops group, extension 4417

changed: [rocky01]

TASK [Time sync runs now and after every boot] *********************************
ok: [rocky01]

PLAY RECAP *********************************************************************
rocky01                    : ok=7    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

The diff shows the one line that would change in /etc/motd on rocky01, and the recap says changed=1, but nothing has been written: ssh rocky01 cat /etc/motd still shows the old line. This is how you review a change before it touches production, and --limit is how you try it on one server before all of them. Now apply it to both:

ansible-playbook baseline.yml -K
ssh rocky01 cat /etc/motd

rocky01 (10.10.10.11) - SaatLab Rocky 10.2
Managed by Ansible from ubu01. Changes made by hand will be overwritten.
Ops contact: saatops group, extension 4417

✅ Checkpoint: The check run showed a diff without changing the file, the real run reported changed=1 per host, and /etc/motd on rocky01 has the new line.