Table of Contents

1. Challenge

   Create a Template *sudoers* File in `/home/ansible/hardened.j2` That Produces a File with Appropriate Output for Each Host

   touch /home/ansible/hardened.j2

2. Challenge

   The Deployed File Should Resemble the Example File Except with the *IP* and *hostnames* Customized Appropriately

   Edit hardened.j2 to contain the following text:

       %sysops {{ ansible_default_ipv4.address }} = (ALL) ALL
       Host_Alias WEBSERVERS = {{ groups['web']|join(', ') }}
       Host_Alias DBSERVERS = {{ groups['database']|join(', ') }} 
       %httpd WEBSERVERS = /bin/su - webuser
       %dba DBSERVERS = /bin/su - dbuser
   

3. Challenge

   Create a Playbook in `/home/ansible/security.yml` That Uses the Template Module to Deploy the Template on All Servers in the Default Ansible Inventory After Validating the Syntax of the Generated File

   Edit /home/ansible/security.yml to contain the following:

   ---
   - hosts: all
     become: yes
     tasks:
     - name: deploy sudo template
       template:
         src: /home/ansible/hardened.j2
         dest: /etc/sudoers.d/hardened
         validate: /sbin/visudo -cf %s
   

4. Challenge

   Run the Playbook and Ensure the Files Are Correctly Deployed

   ansible-playbook /home/ansible/security.yml

   Check the local /etc/sudoers.d/hardened on the ansible control node for the correct contents.