Using Delinea Playbooks for Ansible

Installing Ansible

Ansible is widely available on Linux OS and can be installed using the Yum command on all RedHat type distributions. You can also use Ansible on additional distributions. For more information on additional distributions, refer to Ansible documentation .

Enabling Windows Management with Ansible

Ansible is used to manage Windows systems using PowerShell commands and command lines over WinRM.

  • To enable Windows management by using the Ansible “winrm” module, install the Python module as documented by Ansible.

  • For details on enabling Windows management with Ansible, refer to Ansible documentation.

Preparing for Delinea Automation

Automation includes unattended silent installation and bypassing password type credentials reserved for interactive authentication. Delinea recommends the following practice for silent installation and automated management:

  • Delinea software deployment on Unix and Linux is supported using Delinea repository which can be addressed publicly (or mirrored if you are planning to use it for deployment onto systems that cannot access the Internet).

  • For Active Directory management operation, Delinea recommends using a privileged service account and to maintain a Kerberos keytab file to avoid using password authentication.

  • For Delinea Identity Platform Management operation, Delinea recommends using registration codes for system enrollment and OAuth2 protocol for REST API calls.

Configuring Delinea Repo

Ansible is used to manage the repository configuration (included into the sample Playbooks below). The Delinea repo should be configured first on your Ansible server using the appropriate configuration based on your Linux distribution. The setup example below shows how to setup a Yum repository assuming that the Ansible server is using RedHat Enterprise Linux or a RedHat derivative distribution (example: CentOS, Fedora, etc.).

Setup example using Yum repo:

  1. Obtain your repo key, by following instructions in the Delinea Customer Portal.

  2. Setup the repo by creating /etc/yum.repos.d/centrify.repo:

Copy 
[centrify]
                name=centrify
                baseurl=https://username:password@repo.centrify.com/rpm-redhat/
                enabled=1
                repo_gpgcheck=1
                gpgcheck=1
                gpgkey=https://downloads.centrify.com/products/RPM-GPG-KEY-centrify
  1. Verify proper operation
Copy 
                $ sudo yum list Centrify*
                $ sudo yum info CentrifyDC

                centrify
                Available Packages
                Name        : CentrifyDC
                Arch        : i386
                Version     : 5.3.1
                Release     : 324
                Size        : 24 M
                Repo        : centrify
                Summary     : Centrify DirectControl Agent
                URL         : http://www.centrify.com/  

For more details on all Delinea repos available, login to the Delinea Customer Portal and visit https://support.delinea.com/s/.

Configuring the Service Account Kerberos Secret

To join servers to the Active Directory using the Delinea agent requires privileged authentication to create or update data in the Active Directory domain. Delinea adjoin command support three different methods to perform the administrative operations in Active Directory:

  • Interactive authentication, using an Active Directory privileged user principal and providing credentials when prompted. This option is ideal for a manual join. Any automation scenario would use either options below instead, as they do not require password disclosure.

  • Kerberos authentication, using Kerberos ticket-granting-ticket of a privileged service account. In order to obtain a Kerberos ticket-granting-ticket for a service account principal, Delinea recommends using a Kerberos secret commonly named a keytab file (short for “key table”). A keytab is a file containing pairs of Kerberos principals and encrypted keys (which are derived from the Kerberos password). You can use a keytab file to authenticate to various remote systems using Kerberos without entering a password. However, when you change your Kerberos password, you will need to recreate all your keytabs. Keytab files are commonly used to allow scripts to automatically authenticate using Kerberos, without requiring human interaction or access to password stored in a plain-text file. The script is then able to use the acquired credentials to access files stored on a remote system.

  • Self-service authentication, using a pre-created computer account in Active Directory.

Creating a Kerberos secret named /etc/adjoin.keytab for service account:

Copy 
[root@lnx-prodapp01 ~]# adkeytab --keytab /etc/adjoin.keytab --user admin-cathy@domain.com --adopt svc_centrifyadjoin
admin-cathy@DOMAIN.COM's password:
Success: Adopt Account: svc_centrifyadjoin
[root@lnx-prodapp01 ~]# ls -l /etc/adjoin.keytab
-rw-------. 1 root root 237 Mar 18 09:42 /etc/adjoin.keytab
 |

The user specified to adopt the service account must be a privileged Active Directory user with permissions to change the password of the targeted service account. Service Account should be granted permissions to join computers to zones, remove computers from zones, and manage computer passwords.

You can verify the keytab file by listing the Keylist (Principals) using the Kerberos utility tool.

Copy 
[root@lnx-prodapp01 ~]# ktutil
ktutil:  read_kt /etc/adjoin.keytab
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1    3          svc_centrifyadjoin@DOMAIN.COM
2    3          svc_centrifyadjoin@DOMAIN.COM
3    3          svc_centrifyadjoin@DOMAIN.COM
ktutil:  quit

As a final verification, use the keytab file to obtain a Kerberos ticket-granting-ticket for the service account principal.

Copy 
[root@lnx-prodapp01 ~]# kinit -kt /etc/adjoin.keytab svc_centrifyadjoin@DOMAIN.COM
[root@lnx-prodapp01 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: svc_centrifyadjoin@DOMAIN.COM
Valid starting     Expires            Service principal
18/03/20 11:20:51  18/03/20 21:20:51  krbtgt/DOMAIN.COM@DOMAIN.COM
renew until 19/03/20 11:20:51

For the adjoin command to be able to validate the krbtgt for kerberised join, you must edit the Kerberos configuration file (/etc/krb5.conf) to list the Kerberos realm (Active Directory domain) to use.

Creating a Registration Code

To allow unattended enrollment of systems into the Delinea Identity Platform, create a registration code that will be used to authenticate and allow the enrollment of a system when using the cenroll command from the Delinea Client or a custom script using REST API.

Creating a registration code in Delinea Privileged Access Service portal:

  1. Login to the Delinea Privileged Access Service portal with an account member of System Administrators Role.

  2. Navigate to Settings > Enrollment > Enrollment Codes then click on Add button.

  3. On the Settings tab, choose a Delinea Role as owner of this registration code.

    alt

  4. On the IP Range Restrictions tab, it is recommended to list the public IP from which you will allow this code to be used (or internal IP and ranges if using a customer managed PAS installation instead of a Delinea Cloud tenant).

  5. On the System Sets Allowed tab, you can restrict the list of System Sets you allow the system to be added upon enrollment.

  6. After saving the registration code, you will be invited to copy the generated code for future use (you can view the registration code again any time by selecting an existing code and Actions).

The registration code can be limited in time by setting an expiration or a number of systems to be enrolled before expiration. You can create more than one registration codes at any time, which can help delegation of multiple environment. Owner of a registration code will have permissions automatically set on systems enrolled using the registration code.

Using Delinea Automation Playbooks

You can manage Delinea agent deployment thanks to Delinea public repository available for all Delinea Privilege Services customers. Below are examples of playbooks for simple Delinea agents management tasks. These examples use Yum assuming that managed servers are using RedHat Enterprise Linux or a RedHat derivative distributions (CentOS, Fedora, etc.). Feel free to edit those examples to support other platforms and package management solution (for example, you may prefer to use Aptitude on Debian and derivative distributions).

You can also combine those playbooks into shorter or longer lists of tasks according to your needs, as you may want to perform installation and Active Directory in one single playbook or add Delinea agent deployment to existing orchestration flow. Finally, and depending of your needs, you may want to add more error handling to make those playbooks fully idempotent in your environment.

Delinea Agents Installation Playbook

The playbook below performs the following tasks:

  • Create the configuration file for the Delinea repository if not already present.

  • Install DelineaDC and DelineaDA packages using Yum.

Playbook example installingDelineaagents:

Copy 
---
- hosts: all
  become: true
  vars:
    centrify_repo: /etc/yum.repos.d/centrify.repo
  tasks:
    - name: Check if centrify.repo exists
      stat:
        path: "{{centrify_repo}}"
      register: filecheck
    - name: Create centrify.repo if it doesn't exist
      copy:
        src: "{{centrify_repo}}"
        dest: "{{centrify_repo}}"
        owner: root
        group: root
        mode: '0644'
      when: filecheck.stat.exists == false
    - name: Install Centrify Agents packages
      yum:
        update_cache: yes
        name:
          - CentrifyDC
          - CentrifyDA
        state: latest

Using Delinea Agents Uninstall Playbook

The playbook below performs the following tasks:

  • Check if DelineaDC package is installed (skip further actions if not installed).

  • Check if computer is joined to domain (skip further actions if not joined).

  • Uninstall DelineaDC and DelineaDA packages using Yum.

Playbook example uninstallingDelineaAgents:

Copy 
---
- hosts: all
  become: true
  vars:
    centrify_repo: /etc/yum.repos.d/centrify.repo
  tasks:
    - name: Check if CentrifyDC is installed
      yum:
        list: 'CentrifyDC'
      register: yum_cmd
    - name: Check if computer is joined to domain
      command: adinfo
      register: adinfo_cmd
      changed_when: adinfo_cmd.rc == 10
      failed_when: adinfo_cmd.rc != 10
    - name: Remove Centrify Agents packages
      block:
        - name: Remove CentrifyDC, CentrifyDC-curl, CentrifyDC-openldap, CentrifyDC-openssl and CentrifyDA packages
          yum:
            name: CentrifyDC
            state: absent
        - name: Delete centrify.repo
          file:
            path: "{{centrify_repo}}"
            state: absent
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - adinfo_cmd.rc == 10

Delinea Agents Activation Playbook

The playbook below performs the following tasks:

  • Check if DelineaDC package is installed (skip further actions if not installed).

  • Check if computer is joined to domain (skip further actions if already joined).

  • Copy Service Account keytab file for Kerberos join and obtain krbtgt.

  • Join computer to domain using krbtgt.

  • Destroy krbtgt and keytab file.

Playbook example running adjoin using Kerberos:

Copy 
---
- hosts: all
  become: true
  vars:
    domain_name: domain.com
    user_principal: svc_centrifyadjoin@DOMAIN.COM
    user_keytab: /etc/adjoin.keytab
    container: domain.com/Centrify/Computers
    zone: domain.com/Centrify/Zones/Global/Linux/Development
    realm_config: /etc/krb5.conf
  tasks:
    - name: Check if CentrifyDC is installed
      yum:
        list: 'CentrifyDC'
      register: yum_cmd
    - name: Check if computer is joined to domain
      command: adinfo
      register: adinfo_cmd
      changed_when: adinfo_cmd.rc == 10
      failed_when:
        - adinfo_cmd.rc != 10
        - adinfo_cmd.rc != 0
    - name: Join computer to Active Directory
      block:
        - name: Copy kerberos config file to guarantee finding realm
          copy:
            src: "{{realm_config}}"
            dest: "{{realm_config}}"
            owner: root
            group: root
            mode: '0644'
        - name: Copy service account's keytab file
          copy:
            src: "{{user_keytab}}"
            dest: "{{user_keytab}}"
            owner: root
            group: root
            mode: '0600'
        - name: Obtain service account's krbtgt
          command: kinit -kt "{{user_keytab}}" "{{user_principal}}"
        - name: Join the computer to Active Directory domain using kerberos
          command: adjoin "{{domain_name}}" --container "{{container}}" --zone "{{zone}}" --verbose
        - name: Destroy service account's krbtgt
          command: kdestroy
        - name: Securely remove service account's keytab file
          command: shred --iterations=1 --remove "{{user_keytab}}"
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - adinfo_cmd.rc == 10

The playbook below performs the following tasks:

  • Check if DelineaDC package is installed (skip further actions if not installed).

  • Check if computer is joined to domain (skip further actions if already joined).

  • Join computer to domain using self-service.

Playbook example running self-service adjoin:

Copy 
---
- hosts: all
  become: true
  vars:
    domain_name: domain.com
  tasks:
    - name: Check if CentrifyDC is installed
      yum:
        list: 'CentrifyDC'
      register: yum_cmd
    - name: Check if computer is joined to domain
      command: adinfo
      register: adinfo_cmd
      changed_when: adinfo_cmd.rc == 10
      failed_when:
        - adinfo_cmd.rc != 10
        - adinfo_cmd.rc != 0
    - name: Join computer to Active Directory
      block:
        - name: Join the computer to Active Directory domain using self-service
          command: adjoin "{{domain_name}}" --selfserve --verbose
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - adinfo_cmd.rc == 10

Self-service join requires pre-creation of a computer account in Active Directory domain, a computer profile in the target Delinea zone and delegate permissions to this computer to join the domain with self-service. This can be done by running the “Prepare UNIX Computer” wizard from the Access Manager console or using the PowerShell cmdlet New-CdmManagedComputer.

Delinea Agents Deactivation Playbook

The playbook below performs the following tasks:

  • Check if DelineaDC package is installed (skip further actions if not installed).

  • Check if computer is joined to domain (skip further actions if not joined).

  • Copy Service Account keytab file for Kerberos join and obtain krbtgt.

  • Remove computer from domain using krbtgt.

  • Destroy krbtgt and keytab file.

Playbook example running adleave:using Kerberos

Copy 
---
- hosts: all
  become: true
  vars:
    user_principal: svc_centrifyadjoin@DOMAIN.COM
    user_keytab: /etc/adjoin.keytab
  tasks:
    - name: Check if CentrifyDC is installed
      yum:
        list: 'CentrifyDC'
      register: yum_cmd
    - name: Check if computer is joined to domain
      command: adinfo
      register: adinfo_cmd
      changed_when: adinfo_cmd.rc == 0
      failed_when:
        - adinfo_cmd.rc != 10
        - adinfo_cmd.rc != 0
    - name: Remove computer from Active Directory
      block:
        - name: Copy service account's keytab file
          copy:
            src: "{{user_keytab}}"
            dest: "{{user_keytab}}"
            owner: root
            group: root
            mode: '0600'
        - name: Obtain service account's krbtgt
          command: kinit -kt "{{user_keytab}}" "{{user_principal}}"
        - name: Leave Active Directory domain
          command: adleave --remove --verbose
        - name: Destroy service account's krbtgt
          command: kdestroy
        - name: Securely remove service account's keytab file
          command: shred --iterations=1 --remove "{{user_keytab}}"
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - adinfo_cmd.rc == 0

Delinea Client Installation Playbook

The playbook below performs the following tasks:

  • Create the configuration file for the Delinea repository if not already present.

  • Install DelineaCC package using Yum.

Playbook example installingDelinea Client:

Copy 
---
- hosts: all
  become: true
  vars:
    centrify_repo: /etc/yum.repos.d/centrify.repo
  tasks:
    - name: Check if centrify.repo exists
      stat:
        path: "{{centrify_repo}}"
      register: filecheck
    - name: Create centrify.repo if it doesn't exist
      copy:
        src: "{{centrify_repo}}"
        dest: "{{centrify_repo}}"
        owner: root
        group: root
        mode: '0644'
      when: filecheck.stat.exists == false
    - name: Install Centrify Agent package
      yum:
        update_cache: yes
        name: CentrifyCC
        state: latest

Delinea Client Uninstallation Playbook

The playbook below performs the following tasks:

  • Check if DelineaCC package is installed (skip further actions if not installed).

  • Check if computer is enrolled with a Delinea tenant (skip further actions if not joined).

  • Uninstall DelineaCC packages using Yum.

Playbook example uninstallingDelinea Client:

Copy 
---
- hosts: all
  become: true
  vars:
    centrify_repo: /etc/yum.repos.d/centrify.repo
  tasks:
    - name: Check if CentrifyCC is installed
      yum:
        list: CentrifyCC
      register: yum_cmd
    - name: Check if computer is joined to Centrify Identity Platform
      command: cinfo
      register: cinfo_cmd
      changed_when: cinfo_cmd.rc == 10
      failed_when:
        - cinfo_cmd.rc != 10
        - cinfo_cmd.rc != 0
    - name: Remove Centrify Client package
      block:
        - name: Remove CentrifyCC package
          yum:
            name: CentrifyCC
            state: absent
        - name: Delete centrify.repo
          file:
            path: "{{centrify_repo}}"
            state: absent
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - cinfo_cmd.rc == 10

Delinea Client Enrollment Playbook

The playbook below performs the following tasks:

  • Check if DelineaCC package is installed (skip further actions if not installed).

  • Check if computer is enrolled to a Delinea tenant (skip further actions if already joined).

  • Enroll computer to Delinea tenant using a registration code.

  • Enroll and manage password for the root account.

Playbook example running cenroll using registration code:

Copy 
---
- hosts: all
  become: true
  vars:
    tenant: <YourTenant>.my.centrify.net
    code: <RegistrationCode>
  tasks:
    - name: Check if CentrifyCC is installed
      yum:
        list: 'CentrifyCC'
      register: yum_cmd
    - name: Check if computer is enrolled to Centrify Identity Platform
      command: cinfo
      register: cinfo_cmd
      changed_when: cinfo_cmd.rc == 10
      failed_when:
        - cinfo_cmd.rc != 10
        - cinfo_cmd.rc != 0
    - name: Enroll computer to Centrify Identity Platform
      block:
        - name: Enroll the computer to Centrify tenant using registration code
          command: cenroll --tenant "{{tenant}}" --code "{{code}}" --features all --force --verbose
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - cinfo_cmd.rc == 10

Delinea Client Unenrollment Playbook

The playbook below performs the following tasks:

  • Check if DelineaCC package is installed (skip further actions if not installed).

  • Check if computer is enrolled to a Delinea tenant (skip further actions if not joined).

  • Unenroll computer from Delinea tenant using machine credentials.

Playbook example running cunenroll:

Copy 
---
- hosts: all
  become: true
  vars:
    tenant: <YourTenant>.my.centrify.net
    code: <RegistrationCode>
  tasks:
    - name: Check if CentrifyCC is installed
      yum:
        list: 'CentrifyCC'
        register: yum_cmd
    - name: Check if computer is enrolled to Centrify Identity Platform
      command: cinfo
      register: cinfo_cmd
      changed_when: cinfo_cmd.rc == 10
      failed_when:
        - cinfo_cmd.rc != 10
        - cinfo_cmd.rc != 0
    - name: Enroll computer to Centrify Identity Platform
      block:
        - name: Enroll the computer to Centrify tenant using registration code
          command: cenroll --tenant "{{tenant}}" --code "{{code}}" --features all --force --verbose
          when:
            - yum_cmd.results | selectattr("yumstate", "match", "installed") | list | length == 1
            - cinfo_cmd.rc == 10