Role-Based Access Control and Privilege Management

Role-Based Access Control and Privilege Management

Implementing proper access controls for Ansible infrastructure prevents unauthorized automation execution and limits blast radius from compromised accounts. Ansible Tower (now AWX) and Red Hat Ansible Automation Platform provide enterprise-grade RBAC capabilities, but even community Ansible deployments can implement effective access controls.

SSH key management forms the foundation of Ansible access control. Each automation user should have unique SSH keys with appropriate restrictions. Implement SSH key rotation policies and use SSH certificates where possible. Configure SSH daemon settings to enforce key-based authentication and disable password authentication.

# Example playbook for implementing SSH security hardening
---
- name: Harden SSH configuration for Ansible access
  hosts: all
  become: yes
  tasks:
    - name: Configure SSH daemon settings
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        state: present
        validate: 'sshd -t -f %s'
      with_items:
        - regexp: '^#?PermitRootLogin'
          line: 'PermitRootLogin no'
        - regexp: '^#?PasswordAuthentication'
          line: 'PasswordAuthentication no'
        - regexp: '^#?PubkeyAuthentication'
          line: 'PubkeyAuthentication yes'
        - regexp: '^#?PermitEmptyPasswords'
          line: 'PermitEmptyPasswords no'
        - regexp: '^#?MaxAuthTries'
          line: 'MaxAuthTries 3'
        - regexp: '^#?ClientAliveInterval'
          line: 'ClientAliveInterval 300'
      notify: restart sshd

    - name: Configure allowed users for SSH
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?AllowUsers'
        line: 'AllowUsers ansible deploy'
        state: present
      notify: restart sshd

    - name: Set up ansible user with restricted sudo
      user:
        name: ansible
        groups: wheel
        shell: /bin/bash
        
    - name: Configure sudo access for ansible user
      copy:
        content: |
          ansible ALL=(ALL) NOPASSWD: /usr/bin/systemctl, /usr/bin/yum, /usr/bin/dnf
          ansible ALL=(ALL) NOPASSWD: /bin/cp, /bin/mv, /bin/chmod, /bin/chown
        dest: /etc/sudoers.d/ansible
        mode: '0440'
        validate: 'visudo -cf %s'

  handlers:
    - name: restart sshd
      service:
        name: sshd
        state: restarted

Privilege escalation in playbooks requires careful consideration. While Ansible's become feature enables privilege escalation when needed, unrestricted sudo access creates security risks. Implement granular sudo rules that limit commands available to the Ansible user. Use become only when necessary and specify the minimum required privileges.