supervacuo's questions

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host

ansible -i ansible_hosts host1 --sudo -K # + commands ...

My problem now is that the user passwords on each host are different, but I can't find a way of handling this in Ansible.

Using -K, I am only prompted for a single sudo password up-front, which then seems to be tried for all subsequent hosts without prompting:

host1 | ...
host2 | FAILED => Incorrect sudo password
host3 | FAILED => Incorrect sudo password
host4 | FAILED => Incorrect sudo password
host5 | FAILED => Incorrect sudo password

Research so far:

• a StackOverflow question with one incorrect answer ("use -K") and one response by the author saying "Found out I needed passwordless sudo"

• the Ansible docs, which say "Use of passwordless sudo makes things easier to automate, but it’s not required." (emphasis mine)

• this security StackExchange question which takes it as read that NOPASSWD is required

• article "Scalable and Understandable Provisioning..." which says:

  "running sudo may require typing a password, which is a sure way of blocking Ansible forever. A simple fix is to run visudo on the target host, and make sure that the user Ansible will use to login does not have to type a password"

• article "Basic Ansible Playbooks", which says

  "Ansible could log into the target server as root and avoid the need for sudo, or let the ansible user have sudo without a password, but the thought of doing either makes my spleen threaten to leap up my gullet and block my windpipe, so I don’t"

  My thoughts exactly, but then how to extend beyond a single server?

• ansible issue #1227, "Ansible should ask for sudo password for all users in a playbook", which was closed a year ago by mpdehaan with the comment "Haven't seen much demand for this, I think most people are sudoing from only one user account or using keys most of the time."

So... how are people using Ansible in situations like these? Setting NOPASSWD in /etc/sudoers, reusing password across hosts or enabling root SSH login all seem rather drastic reductions in security.

vixie-cron e-mails me the output of cron jobs, with one message per job.

I would rather receive messages in batches, with either a configurable number of messages per batch or (better) each batch covering a defined time period. I already use logwatch to get daily e-mails; a solution that could be integrated into this system would be ideal.

I can't find a way of configuring vixie-cron (version 4.1-81) to output to a directory or a log file instead of directly to the SMTP client. I am aware that I can manually redirect the output to a different location in crontab itself, but it seems like there should be a way to change the default.

I also wonder what the best tool for sending the e-mails would be (if not logwatch).

We're monitoring several (~40 so far) servers using Nagios 3, and after some massive headaches trying to check event logs and text logs and so on with active checks, I've got NSCA installed on our Nagios server. The next step is obviously to have backup software report successful runs using send_nsca, and I've got this working on Windows too (from Nagios Exchange) — BackupExec handily supports running commands only after a backup has been verified, and we're after something similar for NTBackup and Windows Server Backup.

I'm very happy to use a batch file to do this, as NTBackup doesn't seem to have this built-in, but I've found conflicting information on whether NTBackup populates %errorcode% properly (i.e. only if the backup ran without errors).

Does anyone have experience or ideas for getting NTBackup to report this information correctly, or is there some other solution we "should" be using?

Regards,

Carl