how to control 100% of the state of a server

Archives Ansible Project
1

Hello

I provision my servers using ansible, but sometimes developers will log into a server and do adhoc things.
Changes that happen on things that have been provisioned by ansible (e.g templated files, changes on configs using ini_file etc) can quickly be spotted by running the playbook using --diff --check
But what about all other “ansible untracked” changes?

For example:

  • someone adds a crontab entry
  • someone alters something in /etc/hosts which is not provisioned by ansible
  • someone installs a package which does not appear at all in my playbooks

I understand that ansible cannot easily solve this unless I write a million rules to catch all such cases.

So, what would a sensible approach to solving this be (apart from denying server access to those people)?

thanks

2

You can use a file alteration monitor (tripwire, aide, osiris) to keep
track of these things. If you don't want to go through all that, you
can use gam and/or inotify to create a poor man's version.

3

Wow, that was an eye opener. Thanks!