Files
..
2026-10-30 17:07:35 -07:00
2026-10-30 17:07:35 -07:00
2026-10-30 17:07:35 -07:00
2026-10-30 17:07:35 -07:00
2026-10-30 17:07:35 -07:00

LFCA 2.2: Best practices

Turning off a service nobody needs, a runbook, a script for a manual task, and a first Ansible playbook.

Before you start

Work as root (sudo -i), so ~ is /root. The lab starts a service this VM doesn't need, listening on TCP port 7070, and creates group developers. It notes whether nginx and Ansible are installed, and reset puts that back. The VM needs internet access to install packages.

Tasks

  1. Check which services listen on the network with ss -tulpn. Find the one on port 7070, which this VM doesn't need, and turn it off now and at boot.
  2. Write a runbook for restarting nginx and checking it came back, then have someone else follow it. Not graded.
  3. Turn a three-step manual task into a shell script: write /root/add-dev.sh that takes a user name, creates that user, adds them to group developers, and creates a directory /srv/NAME they own. Make it executable and run it for user erin.
  4. Install Ansible (the ansible package on Ubuntu, ansible-core on the RHEL family). In /root/ansible, make an inventory file inventory with a [webservers] line followed by localhost ansible_connection=local, and save the chapter's nginx playbook as playbook.yml. Run it against the VM with ansible-playbook -i inventory -K playbook.yml, twice, and compare the output.

Hints

  • ss -tulpn shows the process; systemctl status PID shows its unit. systemctl disable --now UNIT.
  • #!/bin/bash first, $1 is the name; useradd -m, usermod -aG (or useradd -G), mkdir, chown; chmod +x.
  • dnf install ansible-core / apt install ansible. The playbook's hosts: webservers matches the inventory's group; -K asks for the sudo password (as root, just press Enter). The second run should show changed=0.