Configure Ansible

5min
Perform the following tasks to configure Ansible for your environment:
1 | Generate a key pair on the  using pkcs11-tool
Perform the following generation tasks:
a | Set Futurex PKCS #11 environment variables
1
In a terminal, run the following commands to set the required FXPKCS11 environment variables:
Text
export FXPKCS11_MODULE=/path/to/libfxpkcs11.so;

export FXPKCS11_CFG=/path/to/fxpkcs11.cfg;
export FXPKCS11_MODULE=/path/to/libfxpkcs11.so;

export FXPKCS11_CFG=/path/to/fxpkcs11.cfg;
﻿
Be sure to modify the file path to match the location where the libfxpkcs11.so and fxpkcs11.cfg files are stored on your system.
b | Generate a key pair on the  using pkcs11-tool
1
In a terminal, run the following command to create a new RSA key pair on the  using pkcs11-tool:
Text
pkcs11-tool --module $FXPKCS11_MODULE --login --keypairgen --key-type rsa:2048 -- label "ansible_rsa_privatekey" --id "123456"
pkcs11-tool --module $FXPKCS11_MODULE --login --keypairgen --key-type rsa:2048 -- label "ansible_rsa_privatekey" --id "123456"
﻿
The above pkcs11-tool command prompts for the user PIN. Enter the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file. If successful, the command output will list the keys that pkcs11-tool generated on the .
2 | Ansible Playbooks
Ansible uses Playbooks to carry out automated tasks. Within the Playbook file, you can use the  PKCS #11 library to execute various functions by using the , including safeguarding, using SSH private keys, and signing data. For more information on Ansible Playbooks, see the Ansible documentation.
The following examples demonstrate using Playbook:
Use  PKCS #11 with Ansible: SSH example
1
Create a working directory for a new Ansible project.
Text
mkdir ~/ansible_project_01
mkdir ~/ansible_project_01
﻿
2
Go into the new ansible_project_01 directory.
Text
cd ~/ansible_project_01
cd ~/ansible_project_01
﻿
3
Create an inventory file.
Text
nano inventory
nano inventory
﻿
The following example inventory file uses localhost:
Text
[local]
localhost ansible_connection=local 
[local]
localhost ansible_connection=local 
﻿
4
Create a playbook.yml file.
Text
nano playbook.yml
nano playbook.yml
﻿
The following is an example Ansible Playbook file for testing an SSH connection using the private key created on the  in the previous section (ansible_rsa_privatekey).
Text
---
- hosts: local
  vars:
    pkcs11_module: "/usr/local/bin/fxpkcs11/libfxpkcs11.so"
    pkcs11_pin: "safest"
    pkcs11_key_id: "ansible_rsa_privatekey"
  tasks:
    - name: Test connectivity
      command: echo "Hello, PKCS#11"

    - name: SSH to localhost using PKCS#11
      command: ssh -I {{ pkcs11_module }} jtitus@localhost echo "SSH with PKCS#11"
      register: ssh_result

    - name: Show SSH result
      debug:
        var: ssh_result.stdout
---
- hosts: local
  vars:
    pkcs11_module: "/usr/local/bin/fxpkcs11/libfxpkcs11.so"
    pkcs11_pin: "safest"
    pkcs11_key_id: "ansible_rsa_privatekey"
  tasks:
    - name: Test connectivity
      command: echo "Hello, PKCS#11"

    - name: SSH to localhost using PKCS#11
      command: ssh -I {{ pkcs11_module }} jtitus@localhost echo "SSH with PKCS#11"
      register: ssh_result

    - name: Show SSH result
      debug:
        var: ssh_result.stdout
﻿
Replace pkcs11_module with the location of the  PKCS #11 library on your system.
Replace pkcs11_pin with the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.
Replace pkcs11_key_id with the label of the key you set when creating the key pair via PKCS11-tool.
5
Run the following command to execute the playbook while referencing the private key stored on the HSM during the SSH connection step.
Text
sudo ansible-playbook -u <your username> -i inventory playbook.yml -K
sudo ansible-playbook -u <your username> -i inventory playbook.yml -K
﻿
Set the username, inventory, and playbook file information according to your setup.
6
When prompted for the BECOME password, enter it. 
In Ansible, the become directive escalates privileges when running tasks, similar to using sudo in the command line. The become_password parameter is the password for the user specified in become_user (which defaults to root if not specified).
7
When prompted for the password of the user you are connecting to the machine with through SSH, enter it to complete the process.
If successful, you see a response similar to the following:
Text
PLAY [local] ******************************************************************************************************************************************************************************************

TASK [Gathering Facts] ********************************************************************************************************************************************************************************
ok: [localhost]

TASK [Test connectivity] ******************************************************************************************************************************************************************************
changed: [localhost]

TASK [SSH to localhost using PKCS#11] *****************************************************************************************************************************************************************
user@localhost's password: 
changed: [localhost]

TASK [Show SSH result] ********************************************************************************************************************************************************************************
ok: [localhost] => {
    "ssh_result.stdout": "<FXPKCS11 Log Output>" 
}

PLAY RECAP ********************************************************************************************************************************************************************************************
localhost                  : ok=4    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0 
PLAY [local] ******************************************************************************************************************************************************************************************

TASK [Gathering Facts] ********************************************************************************************************************************************************************************
ok: [localhost]

TASK [Test connectivity] ******************************************************************************************************************************************************************************
changed: [localhost]

TASK [SSH to localhost using PKCS#11] *****************************************************************************************************************************************************************
user@localhost's password: 
changed: [localhost]

TASK [Show SSH result] ********************************************************************************************************************************************************************************
ok: [localhost] => {
    "ssh_result.stdout": "<FXPKCS11 Log Output>" 
}

PLAY RECAP ********************************************************************************************************************************************************************************************
localhost                  : ok=4    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0 
﻿
You can verify the successful pulling of the private key within the FXPKCS11 log file.
Use  PKCS #11 with Ansible: Signing data example
1
Create a working directory for a new Ansible project.
Text
sudo mkdir ~/ansible_project_02
sudo mkdir ~/ansible_project_02
﻿
2
Go into the new ansible_project_02 directory.
Text
cd ~/ansible_project_02
cd ~/ansible_project_02
﻿
3
Create an inventory file.
Text
nano inventory
nano inventory
﻿
The following example inventory file uses localhost:
Text
[local]
localhost ansible_connection=local
[local]
localhost ansible_connection=local
﻿
4
Create a playbook.yml file.
Text
nano playbook.yml
nano playbook.yml
﻿
The following is an example Ansible Playbook file for signing data by using the private key created on the  (ansible_rsa_privatekey).
Text
---
- hosts: local
  vars:
    pkcs11_module: "/usr/local/bin/fxpkcs11/libfxpkcs11.so"
    pkcs11_pin: "safest"
    pkcs11_key_id: "ansible_rsa_privatekey"
    data_to_sign: "Sign this data"
  tasks:
    - name: Sign data using PKCS#11
      shell: |
        echo -n "{{ data_to_sign }}" | openssl dgst -engine pkcs11 -keyform engine -sign "pkcs11:object={{ pkcs11_key_id }}" -out signed_data.bin
      register: sign_result
      environment:
        PKCS11_MODULE: "{{ pkcs11_module }}"
        PKCS11_PIN: "{{ pkcs11_pin }}"

    - name: Show signing result
      debug:
        msg: "Data signed successfully"
---
- hosts: local
  vars:
    pkcs11_module: "/usr/local/bin/fxpkcs11/libfxpkcs11.so"
    pkcs11_pin: "safest"
    pkcs11_key_id: "ansible_rsa_privatekey"
    data_to_sign: "Sign this data"
  tasks:
    - name: Sign data using PKCS#11
      shell: |
        echo -n "{{ data_to_sign }}" | openssl dgst -engine pkcs11 -keyform engine -sign "pkcs11:object={{ pkcs11_key_id }}" -out signed_data.bin
      register: sign_result
      environment:
        PKCS11_MODULE: "{{ pkcs11_module }}"
        PKCS11_PIN: "{{ pkcs11_pin }}"

    - name: Show signing result
      debug:
        msg: "Data signed successfully"
﻿
Replace pkcs11_module with the location of the Futurex PKCS #11 library on your system.
Replace pkcs11_pin with the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.
Replace pkcs11_key_id with the label of the key you set when creating the key pair in PKCS11-tool.
5
Run the following command to execute the playbook, while referencing the private key stored on the  to perform the signing operation.
Text
sudo ansible-playbook -u <your username> -i inventory playbook.yml -K
sudo ansible-playbook -u <your username> -i inventory playbook.yml -K
﻿
Set the username, inventory, and playbook file information according to your setup.
6
When prompted for the BECOME password,  enter it. 
In Ansible, the become directive escalates privileges when running tasks, similar to using sudo in the command line. The become_password parameter is the password for the user specified in become_user (which defaults to root if not specified).
If successful, you see a response similar to the following:
Text
PLAY [local] *****************************************************************************

TASK [Gathering Facts] *******************************************************************
ok: [localhost]

TASK [Sign data using PKCS#11] ***********************************************************
changed: [localhost]

TASK [Show signing result] ***************************************************************
ok: [localhost] => {
    "msg": "Data signed successfully"
}

PLAY RECAP *******************************************************************************
localhost                  : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
PLAY [local] *****************************************************************************

TASK [Gathering Facts] *******************************************************************
ok: [localhost]

TASK [Sign data using PKCS#11] ***********************************************************
changed: [localhost]

TASK [Show signing result] ***************************************************************
ok: [localhost] => {
    "msg": "Data signed successfully"
}

PLAY RECAP *******************************************************************************
localhost                  : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
﻿
You can verify the signing operations within the FXPKCS11 log file.
﻿
Updated 11 Dec 2024
Did this page help you?
Install and configure OpenSSL Engine
Ansible Vault