In Ansible, Playbooks perform automated tasks. You can reference the Futurex PKCS #11 library when performing these tasks inside the Playbook file to perform various functions, such as SSH and signing data. For more information on Ansible Playbooks, see the Ansible documentation.
The following example uses Futurex PKCS #11 with Ansible:
1
Create an Ansible project working directory and switch to it.
Shell
sudo mkdir ~/ansible_projectcd ~/ansible_project
2
Create an inventory file.
Shell
sudo nano inventory
The following code shows an example inventory file that uses localhost:
Shell
[local]localhost ansible_connection=local
3
Create a playbook.yml file.
Shell
sudo nano playbook.yml
The following code shows an example Ansible Playbook file for testing SSH referencing the private key created in the previous section (ansible_rsa_privatekey):
Shell
---- hosts: local vars: pkcs11_module: "/usr/local/bin/fxpkcs11/libfxpkcs11.so" pkcs11_pin: "safest" pkcs11_key_id: "ansible_rsa_privatekey" tasks: - name: Test connectivity command: echo "Hello, PKCS#11" - name: SSH to localhost using PKCS#11 command: ssh -I {{ pkcs11_module }} jtitus@localhost echo "SSH with PKCS#11" register: ssh_result - name: Show SSH result debug: var: ssh_result.stdout
Replace pkcs11module with the location of the Futurex PKCS #11 library on your system.
Replace pkcs11pin with the password you configured for the identity created for this integration.
Replace pkcs11keyid with the label of the key you set when creating the key pair through pkcs11-tool.
4
To execute the Playbook and reference the private key stored on the HSM during SSH connection, run the following command, setting the username, inventory, and Playbook file information according to your setup:
When prompted, enter thebecome_password in Ansible. The become directive escalates privileges when running tasks, similar to using sudo in the command line. The become_password is the password for the user specified in become_user (which defaults to root if not specified).
5
When prompted for the password of the user you are connecting to the machine with through SSH, enter it to complete the process.
If successful, you should see a response similar to the following:
Create an Ansible project working directory and switch to it.
Shell
sudo mkdir ~/ansible_projectcd ~/ansible_project
2
Create an inventory file.
Shell
sudo nano inventory
The following code shows an example inventory file that uses localhost:
Shell
[local]localhost ansible_connection=local
3
Create a playbook.yml file.
Shell
sudo nano playbook.yml
The following code shows an example Ansible Playbook file for signing data referencing the private key created in the previous section (ansible_rsa_privatekey):
Shell
---- hosts: local vars: pkcs11_module: "/usr/local/bin/fxpkcs11/libfxpkcs11.so" pkcs11_pin: "safest" pkcs11_key_id: "ansible_rsa_privatekey" data_to_sign: "Sign this data" tasks: - name: Sign data using PKCS#11 shell: | echo -n "{{ data_to_sign }}" | openssl dgst -engine pkcs11 -keyform engine -sign "pkcs11:object={{ pkcs11_key_id }}" -out signed_data.bin register: sign_result environment: PKCS11_MODULE: "{{ pkcs11_module }}" PKCS11_PIN: "{{ pkcs11_pin }}" - name: Show signing result debug: msg: "Data signed successfully"
Replace pkcs11module with the location of the Futurex PKCS #11 library on your system.
Replace pkcs11pin with the password you configured for the identity created for this integration.
Replace pkcs11keyid with the label of the key you set when creating the key pair through pkcs11-tool.
4
To execute the Playbook and reference the private key stored on the HSM during SSH connection, run the following command, setting the username, inventory, and Playbook file information according to your setup:
When prompted, enter the become_password in Ansible. The become directive escalates privileges when running tasks, similar to using sudo in the command line. The become_password is the password for the user specified in become_user (which defaults to root if not specified).
5
When prompted for the password of the user you are connecting to the machine with through SSH, enter it to complete the process.
If successful, you should see a response similar to the following:
Shell
PLAY [local] **************************************************************************TASK [Gathering Facts] *************************************************************ok: [localhost]TASK [Sign data using PKCS#11] *****************************************************changed: [localhost]TASK [Show signing result]*********************************************************ok: [localhost] => { "msg": "Data signed successfully"}PLAY RECAP ****************************************************************************localhost : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
6
You can verify the signing operations within the FXPKCS11 log file or by checking the output file contents.
