Ansible — Ports Monitoring.. Today I will show you how Ansible can... | by Abdelilah OUASSINI | Towards Data Science

Indeed in highly sensitive businesses like banking, ports are strictly supervised, and only required ports are allowed to be opened by SecOps.Otherwise, not supervised ports can be attractive targets for network attacks like DDOS.
To explain things more easily, let’s imagine a set of hosts called sources that should communicate with another set of hosts called targets, only through authorized ports.
Hosts can be cloud, docker, VM, metal server ... and port could be any ( https 443, SMTP 25, PostgreSQL 5432, Ldap 389, elk 9200, Redis 6379 or any other customized ports ).
Now we came to the interesting part :)
As we know, most important part of the SRE/DevOps role is monitoring stuff. So how can the SRE team monitor inter-server port communications easily and effectively, especially on large inventories?
How can they perform health-check after each network patches to confirm there is no regression?
And more importantly, how they can, quickly and reliably, check during a service interruption if the issue is coming from hosts network inter-communication problems?
Before orchestration ( Ansible, Terraform .. ), the solution was to create a shell, PowerShell, or python script to telnet or ping any of the targets hosts. The big downside of this solution is the necessity to launch the script manually in all the source servers, one by one.
With Ansible, things became smarter, automated, and easier.
Indeed, we can create a task ( could be cron job ) that will be executed from all the source hosts to check communications with all target hosts through defined ports and send reports/alerts in case of issues.
Let’s move now to the coding parts :)
We will start by creating the ansible main tasks:roles/ansible-role-ports/tasks/main.yml
---- name: Check global ports  wait_for:    host: "{{ item.name }}"    port: "{{ item.port }}"    state: started         # Port should be open    delay: 0               # No wait before first check (sec)    timeout: 3             # Stop checking after timeout (sec)  ignore_errors: yes  with_items: "{{ server_to_test }}"
This is the main ansible role task indicating that telnet will be done from the “item.name” to the list of hosts in “server_to_test” through port “item.port”.
Let now create our play:plays/ports/ports.yml
---- name: check ports  hosts: "{{ host }}"  become: yes  become_user: root  roles:    - ansible-role-ports
This is the ansible play that will call the task by using source and target hosts from the inventory.
Regarding the inventory, it is just listing the hosts ( sources and targets ), each with a group_vars parameter that specifies the target host and the targeted port to use for each set of sources servers.
inventory/hosts-update.yml
source1:  hosts:    host1:      ansible_host: ip-source1-host1      host_name: source1-host1    host2:      ansible_host: ip-source1-host2      host_name: source1-host2      source2:  hosts:    host1:      ansible_host: ip-source2-host1      host_name: source2-host1    host2:      ansible_host: ip-source2-host2      host_name: source2-host2      target1:  hosts:    host1:      ansible_host: ip-target1-host1      host_name: target1-host1    host2:      ansible_host: ip-target1-host2      host_name: target1-host2           target2:  hosts:    host1:      ansible_host: ip-target2-host1      host_name: target2-host1    host2:      ansible_host: ip-target2-host2      host_name: target2-host2
And finally the group_vars for each set of source hosts :
inventory/group_vars/source1.yml
---server_to_test:  - {name: 'target1', port: 'port1'}#target1  - {name: 'target1', port: 'port2'}#target1    - {name: 'target2', port: 'port1'}#target2  - {name: 'target2', port: 'port2'}#target2
inventory/group_vars/source2.yml
---server_to_test:  - {name: 'target1', port: 'port3'}#target1  - {name: 'target1', port: 'port4'}#target1
The usage of the play is as follows:
---ansible-playbook -i inventory/hosts-update.yml plays/ports/ports.yml — extra-vars ‘{“host”:”source1,source2”}’ -k -K -vv -u “USER”
Source1, source2 can be changed by any other set of hosts.
We are done, so as always, I hope you have learned something new.see you later :)