# Playbook ansible permisos **URL:** \ **Category:** Get Help\ **Created:** [June 9, 2024, 6:19am UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258 "2024-06-09T06:19:27Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 9, 2024, 6:19am UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/1 "2024-06-09T06:19:27Z")
I have many vulnerabilities on different servers on different routes on each server, I must remove the write permission from others just remove the write permission from others… there are many servers and on different routes how could I do using ansible? ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 9, 2024, 7:43pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/2 "2024-06-09T19:43:25Z")
Hello @Jasonroot1. It isn’t clear to me what you mean by “routes on … servers”. I’m going to guess you aren’t talking about network routes, partly because that involves firewalls, DNS, and other things I’m particularly uninterested in and rather useless at anyway. (Just ask my co-workers!) I’m also hoping it’s not about http server configuration such as Apache Location, Directory, or Alias directives. If you mean permissions on directories, then you can probably fix your permissions issues with [the `ansible.builtin.file` module](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html). That module lets you manage pretty much everything about files (and directories) except their content. If the `path` parameter is a directory name, and you set the `state` parameter to `"directory"`, then you can use the `mode` parameter to specify the permissions that directory should have. In the case where `state: directory`, you can also set `recurse: true` to set the mode as specified for that directory and all subdirectories of that directory. Like this: ```yaml - name: Recursively remove "read,write,execute" mode for "other" ansible.builtin.file: path: '{{ tgt }}' mode: 'o-rwx' state: directory recurse: true ``` You can loop over a list of top-level directories and remove the “other” mode bits like this: ```yaml - name: Recursively remove "read,write,execute" mode for "other" in several places ansible.builtin.file: path: '{{ item }}' mode: 'o-rwx' state: directory recurse: true loop: - /opt/local/server1/data - /var/tmp/server1 - /tmp/server1/foo ``` Beware though. You mentioned “many servers on different routes”. If you run the above task on multiple hosts, it will create those directories on any hosts where they don’t already exist. This may not be acceptable, in which case you could either: - check their existence on each host first with the `ansible.builtin.stat` module, and execute the above task only on directories that already exist, or - use the `ansible.builtin.shell` module to `find` directories on your list and chmod them as appropriate using a carefully crafted shell script. Let us know if this addresses your issue, and how you get on with solving the problem. As always, please include any relevant details. Reducing the guess work we have to do increases the quality of the help we can offer you — a win-win! ---
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 9, 2024, 9:18pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/3 "2024-06-09T21:18:41Z")
I have a list of servers where there are many different directories for each server where I must remove write permissions for others in each directory, is there a way to generate the server inventory with the directories and that the removal of the write permission is applied? ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 9, 2024, 9:45pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/4 "2024-06-09T21:45:48Z")
You have a list of servers, so that’s your inventory. I don’t particularly like putting variable values (with perhaps an exception for connection parameters) in inventories. I prefer to create `group_vars` files where possible, and `host_vars` files where necessary, and to populate them with whatever variables I need. But to answer your question: sure, there are _lots of ways_ to associate lists of directories that match whatever criteria you want with individual hosts or groups of hosts. Let me turn the question around, since I know nothing about these hosts or the directories on them: On any given server, how would you identify which directories you need to “fix” the permissions on? That is, if you had to do this by hand, how would you find them? Once that’s understood, you can use Ansible to automate that discovery process. Alternatively, perhaps you can produce a “global” list of all such directories across all your hosts, with the understanding that not all these directories will necessarily exist on all the hosts. If so, you can use Ansible to fix the directories in that list on each host, skipping the ones that don’t exist on particular hosts of course. A third method would be to start at the root level and _exclude_ all the “normal” directories - those that are part of all systems - leaving only the potential target directories. But that’s a rather scary way to go about it; one mistake could leave a lot of machines in a bad way. Maybe better to forget I even mentioned this “3rd rail” approach. Whichever way you choose, you also have to decide whether to combine the “problem directory discovery” process with the “fix problem directory” process, or alternatively to use the discovery process to generate lists to use in a later process. You’re in a much better position than I am to determine which approach to take, since you presumably have some idea about your directory layouts and I certainly don’t. But once you pick a method, after that it’s “just” filling in the details. ---
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 10, 2024, 4:34am UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/5 "2024-06-10T04:34:48Z")
> [@utoddl](#): > > ou have a list of servers, so that’s your inventory. > > I don’t particularly like putting variable values (with perhaps an exception for connection parameters) in inventories. I prefer to create `group_vars` files where possible, and `host_vars` files where necessary, and to populate them with whatever variables I need. > > But to answer your question: sure, there are _lots of ways_ to associate lists of directories that match whatever criteria you want with individual hosts or groups of hosts. > > Let me turn the question around, since I know nothing about these hosts or the directories on them: On any given server, how would you identify which directories you need to “fix” the permissions on? That is, if you had to do this by hand, how would you find them? Once that’s understood, you can use Ansible to automate that discovery process. > > Alternatively, perhaps you can produce a “global” list of all such directories across all your hosts, with the understanding that not all these directories will necessarily exist on all the hosts. If so, you can use Ansible to fix the directories in that list on each host, skipping the ones that don’t exist on particular hosts of course. > > A third method would be to start at the root level and _exclude_ all the “normal” directories - those that are part of all systems - leaving only the potential target directories. But that’s a rather scary way to go about it; one mistake could leave a lot of machines in a bad way. Maybe better to forget I even mentioned this “3rd rail” approach. > > Whichever way you choose, you also have to decide whether to combine the “problem directory discovery” process with the “fix problem directory” process, or alternatively to use the discovery process to generate lists to use in a later process. > > You’re in a much better position than I am to determine which approach to take, since you presumably have some idea about your directory layouts and I certainly don’t. But once you pick a method Hi, The case is the following, I have vulnerabilities about permissions in different directories on different servers, not all directories are on all servers, I must remove write permissions for others for example ( permissions 664 ) I thought of copying a file with the hosts and the corresponding routes on each server and create a playbook that will first run join me and print the result in the following as a variable and execute a command, for example: FIND . -name ‘hostname’ awk print $2 ( it would be the directory ) and this print it in the next task so that it looks like this way: chmod o-w directory There are many directories, manually it takes a lot of time and for security reasons it is not allowed to run a script ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 10, 2024, 10:16am UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/6 "2024-06-10T10:16:33Z")
> [@Jasonroot1](#): > > I thought of copying a file with the hosts and the corresponding routes on each server and > [@Jasonroot1](#): > > There are many directories, manually it takes a lot of time This is beginning to point at useful details. Specifically: 1. Can you produce a list of directories of interest? 2. For any such directory, can we assume that all of its subdirectories are subject to the same treatment? ---
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 10, 2024, 3:28pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/7 "2024-06-10T15:28:45Z")
> [@utoddl](#): > > > [@Jasonroot1](#): > > > > takes a lot of time > > This is beginning to point at useful details. Specifically: > > 1. Can you produce a list of directories of interest? > 2. For any such directory, can we assume that all of its subdirectories are subject to the same treatment? They are files files, I have the list of everything, for example. /example/example/example.log, which I don’t know is how to do it in bulk, How to tell him to look for the server within a list and look for the files and change the permission, I don’t know how to tell him to look for uj file where the directories or files are, I have only worked with inventory hosts, I don’t know how to do it ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 10, 2024, 7:14pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/8 "2024-06-10T19:14:40Z")
If you have your list of everything, you can plug it into the following and fix the mode bits for “other”. Feel free to ask about anything that isn’t clear. ```yaml --- # file-mode-fix.yml - name: File mode parameter hosts: localhost # ← Use whatever is appropriate here gather_facts: false vars: paths_to_fix: # List of all "interesting" files and directories on all hosts - /tmp/file-mode-fix/aaa - /tmp/file-mode-fix/aaa/iii - /tmp/file-mode-fix/aaa/iii/w.ext - /tmp/file-mode-fix/aaa/iii/x.ext - /tmp/file-mode-fix/aaa/iii/y.ext - /tmp/file-mode-fix/aaa/jjj/v.ext - /tmp/file-mode-fix/aaa/jjj/z.ext - /tmp/file-mode-fix/bbb - /tmp/file-mode-fix/bbb/iii/x.ext - /tmp/file-mode-fix/bbb/iii/y.ext - /tmp/file-mode-fix/ccc - /tmp/file-mode-fix/ccc/iii/y.ext - /tmp/file-mode-fix/ccc/jjj/y.ext - /tmp/file-mode-fix/ccc/jjj/y.ext tasks: - name: Stat paths_to_fix ansible.builtin.stat: path: '{{ item }}' loop: '{{ paths_to_fix }}' register: paths_stats - name: Save stats of existing directories ansible.builtin.set_fact: stats_dirs: '{{ paths_stats.results | selectattr("stat.exists") | selectattr("stat.isdir") }}' - name: Fix mode of directories ansible.builtin.file: path: '{{ item.item }}' mode: 'o-rwx' # or however you want to change directory modes state: directory recurse: true # or false if you don't want to do this to all sub-directories loop: '{{ stats_dirs }}' - name: Save stats of existing files ansible.builtin.set_fact: stats_files: '{{ paths_stats.results | selectattr("stat.exists") | selectattr("stat.isreg") }}' - name: Fix mode of files ansible.builtin.file: path: '{{ item.item }}' mode: 'o-rwx' # or however you want to change file modes state: file loop: '{{ stats_files }}' ``` ---
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 10, 2024, 9:24pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/9 "2024-06-10T21:24:40Z")
paths\_to\_fix: # List of all “interesting” files and directories on all hosts Couldn’t it be a txt file or a kind of inventory where I consult? There are a lot of directories/files ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 10, 2024, 9:51pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/10 "2024-06-10T21:51:45Z")
It could be, yes. There are lots of different ways to get a list into Ansible. And that code I posted is just one way to go about it. If this is a one-off task, I wouldn’t put much effort into making it beautiful or efficient. On the other hand, if you intend to repeat the process periodically, then you may want to think about how to refresh the list, whether to come up with a way to do it host-by-host, etc. You’ve said something equivalent to “a lot of directories/files” several times, but you’ve never given a hint what you think of as “a lot”. For me, it isn’t “a lot” until it’s more that 10,000. Others may reasonably draw the line at “a couple of screen fulls”. I routinely edit files with over a million lines. And by “edit” I mean “run some macros on”. One’s notion of “a lot” depends on how well your tool chain allows your processes to remain painless. ---
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 10, 2024, 10:30pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/11 "2024-06-10T22:30:20Z")
There are approximately 5000, the playbooks that I have generated have already been for another type of simpler tasks, and it is a relatively periodic task, I do not know how to use a list from a txt, I apologize my level in Ansible is still very basic I am still learning and so far what you have shared with me has filled me with great knowledge, I do not know if you could tell me how I could do it by calling a file where you are the directories, that I can use it next month, as I told you it is a topic related to remediation of vulnerabilities so it is something that will be executed in a cyclical way ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 10, 2024, 11:25pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/12 "2024-06-10T23:25:30Z")
Okay, here’s an even shorter version that loads the list of files and directories from a file. The `grep` in the first task skips blank lines and lines where the first non-space character is a pound sign (`#`), so you can put in comments and some white-space to help manage the file. There’s a commented-out one-line quick-n-dirty `debug` task in case you want to see how the registered output from the `stat` module is structured. This version dispenses with the `set_fact` steps, instead looping over `paths_stats` filtered to include just the directory names or file names relevant to your target host. Change the value of “`paths_to_fix_filename`” to point to your file of file and directory names. You might want to experiment with a very small subset of files – five or six maybe – on a very small subset of target hosts (1?) until you’re comfortable with what it’s doing. The biggest question in the “what it’s doing” category is about the “`recurse: true`” on the “Fix mode of existing directories” task. That’s a mighty big hammer for a guy with only two thumbs, so be careful. ```yaml --- # file-mode-fix.yml - name: File mode parameter hosts: localhost # ← Use whatever is appropriate here gather_facts: false vars: paths_to_fix_filename: file-mode-fix-interesting_files.txt tasks: - name: Load interesting_files ansible.builtin.command: grep -v -E '^ *(#.*)?$' "{{ paths_to_fix_filename }}" changed_when: false register: paths_to_fix - name: Stat paths_to_fix ansible.builtin.stat: path: '{{ item }}' loop: '{{ paths_to_fix.stdout_lines }}' register: paths_stats # - debug: msg='{{ paths_stats }}' - name: Fix mode of existing directories ansible.builtin.file: path: '{{ item }}' mode: 'o-rwx' # or however you want to change directory modes state: directory recurse: true # or false if you don't want to do this to all sub-directories loop: '{{ paths_stats.results | selectattr("stat.exists") | selectattr("stat.isdir") | map(attribute="stat.path") }}' - name: Fix mode of existing files ansible.builtin.file: path: '{{ item }}' mode: 'o-rwx' # or however you want to change file modes state: file loop: '{{ paths_stats.results | selectattr("stat.exists") | selectattr("stat.isreg") | map(attribute="stat.path") }}' ``` ---
**Author:** ![Jasonroot1](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@Jasonroot1](https://forum.ansible.com/u/Jasonroot1)\ **Post date:** [June 12, 2024, 10:16pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/13 "2024-06-12T22:16:23Z")
It doesn’t work, the online routes, it takes them as if they were the same line ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 12, 2024, 11:05pm UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/14 "2024-06-12T23:05:20Z")
Interesting. It worked with my sample. Do you know what the line termination character(s) is/are on the file? This would show us: `$ head online_routes.txt | od -tx1a` ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 13, 2024, 2:04am UTC](https://forum.ansible.com/t/playbook-ansible-permisos/6258/17 "2024-06-13T02:04:01Z")
You’re looping over `paths_to_fix_filename`, which is supposed to be the name of the file that has the paths of interest. It’s just a string; a file name. What you’re supposed to be looping over is the registered result from the prior step, which you have called `variable_result`. Look over the [code from earlier](http://forum.ansible.com/t/playbook-ansible-permisos/6258/12). It’s not what you are running. Study it a bit more. You’ll get there eventually.