Introduction
Security automation often focuses on accounts, ownership, permissions, and evidence. A good playbook applies these settings without weakening access to the management user.
In this lab, you will create a locked system account, deploy root-owned security policy files, collect SELinux mode evidence, and prove the playbook is idempotent.
Create a Security Automation Project
In this step, you will create a project for a safe security baseline that avoids changing LabEx SSH or sudo access.
cd /home/labex/project
mkdir -p rhce-ansible/{inventory,playbooks,reports}
cd rhce-ansible
cat > ansible.cfg <<'EOF'
[defaults]
inventory = ./inventory/hosts
host_key_checking = False
retry_files_enabled = False
EOF
cat > inventory/hosts <<'EOF'
[managed]
host ansible_connection=local
EOF
This lab deliberately avoids changing the labex account, SSH service, or sudo access. The managed account and policy files are isolated practice targets.
Define Security Baseline Variables
In this step, you will define the account, directory, and policy file that the playbook will manage. Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
mkdir -p inventory/group_vars
cat > inventory/group_vars/managed.yml <<'EOF'
audit_user: rhce_audit
security_dir: /etc/rhce-security
security_policy: /etc/rhce-security/policy.conf
EOF
The variables name the service account and the root-owned policy path. Keeping them in variables makes the security baseline easier to audit before it changes system state.
cat inventory/group_vars/managed.yml
Write the Security Baseline Playbook
In this step, you will write a playbook that creates a locked system account, a root-owned directory, a mode 0600 policy file, and a workspace evidence report.
Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
cat > playbooks/security-baseline.yml <<'EOF'
---
- name: Apply safe security baseline
hosts: managed
become: true
gather_facts: true
tasks:
- name: Ensure locked audit service account exists
ansible.builtin.user:
name: "{{ audit_user }}"
system: true
shell: /sbin/nologin
create_home: false
password_lock: true
state: present
- name: Ensure root-owned security directory exists
ansible.builtin.file:
path: "{{ security_dir }}"
state: directory
owner: root
group: root
mode: '0750'
- name: Deploy root-only security policy
ansible.builtin.copy:
dest: "{{ security_policy }}"
owner: root
group: root
mode: '0600'
content: |
managed_by=ansible
selinux_status={{ ansible_selinux.status | default('unknown') }}
- name: Check current SELinux mode
ansible.builtin.command: getenforce
register: selinux_mode
changed_when: false
failed_when: false
- name: Write learner-readable security report
ansible.builtin.copy:
dest: /home/labex/project/rhce-ansible/reports/security-report.txt
owner: labex
group: labex
mode: '0640'
content: |
audit_user={{ audit_user }}
policy_mode=0600
selinux_mode={{ selinux_mode.stdout | default('unknown') }}
EOF
The playbook combines enforcement and evidence. It creates a locked system account, writes root-only policy files, reads SELinux mode without marking the task changed, and writes a learner-readable report back into the project.
ansible-playbook playbooks/security-baseline.yml --syntax-check
Review the security-sensitive values before running: shell: /sbin/nologin, password_lock: true, root ownership, and mode 0600 on the policy file.
Run and Inspect the Security Baseline
In this step, you will apply the baseline and inspect the account, file permissions, and evidence report.
cd /home/labex/project/rhce-ansible
ansible-playbook playbooks/security-baseline.yml | tee reports/security-first.txt
The first run should create the account and policy directory. The checks below confirm the system state directly instead of trusting the playbook output alone.
getent passwd rhce_audit
The account entry should end with /sbin/nologin, showing it is not intended for interactive shell access.
sudo stat -c "%U:%G %a %n" /etc/rhce-security /etc/rhce-security/policy.conf
The policy file should be owned by root:root and use mode 600, which is appropriate for root-only policy content.
cat reports/security-report.txt
The report records the managed account, expected policy mode, and observed SELinux mode for quick review.
Confirm Security Baseline Idempotence
In this step, you will run the security baseline again. Existing secure state should not need further changes.
cd /home/labex/project/rhce-ansible
ansible-playbook playbooks/security-baseline.yml | tee reports/security-second.txt
The second run verifies that the security baseline converges. If it reports changes again, inspect which task changed because that means one desired state was not stable.
grep -E 'host.*changed=0' reports/security-second.txt
Summary
You automated a locked service account, root-owned security policy files, SELinux evidence collection, and idempotence validation without changing the LabEx access path.
