Please enable JavaScript.
Coggle requires JavaScript to display documents.
Phase 1 - Enterprise Linux Infrastructure (Centralized Patch Management…
Phase 1 - Enterprise Linux Infrastructure (Centralized Patch Management Lab)
Objective
Build enterprise-ready infrastructure
Prepare for
Ansible
AWX
Wazuh
ELK Stack
Centralized Patch Management
Automation
End Goal
Controller manages all Linux servers
Static IP addressing
SSH connectivity
Internet access
Name resolution
Secure communication
Enterprise scalability
Enterprise Architecture
Windows Host
VMware Workstation Pro
Virtual Infrastructure
Virtual Switch
NAT Network
Internet Connectivity
Management Layer
ansible-controller
Managed Nodes
Ubuntu Servers
Debian Servers
Rocky Linux Servers
AlmaLinux Servers
Communication
SSH (Port 22)
Controller initiates connections
Agentless Management
Enterprise Workflow
Administrator
Connects to Controller
Controller
Executes Playbooks
Pushes Configurations
Deploys Updates
Collects Facts
Target Servers
Receive SSH Requests
Execute Tasks
Return Results
Hardware Planning
CPU Planning
Avoid CPU Overcommit
Reserve Host Resources
Allocate vCPUs based on workload
Memory Planning
Controller
4 GB
Managed Nodes
2 GB each
Storage Planning
SSD Preferred
Controller
40 GB
Managed Nodes
20 GB
Enterprise Best Practices
Leave 40-50% host RAM free
Use SSD
Enable virtualization extensions
VMware Installation
Install VMware Workstation Pro
Verify
Library
Virtual Network Editor
VM Settings
Snapshot Manager
Enterprise Best Practices
Store VMs on SSD
Separate ISO folder
Separate VM folder
BIOS Configuration
Enable
Intel VT-x
AMD-V
Virtualization Technology
Verify
Windows Task Manager
Performance
CPU
Virtualization Enabled
ISO Repository
Folder
D:\ISO
Operating Systems
Ubuntu Server 24.04 LTS
Debian 12
Rocky Linux 9
AlmaLinux 9
Enterprise Practice
Maintain latest ISOs
Verify checksums
Archive previous versions
Virtual Network Design
NAT Network
Advantages
Internet Access
Package Updates
Git Access
Repository Access
Gateway
192.168.100.2
Network
192.168.100.0/24
DNS
8.8.8.8
1.1.1.1
Host-only Network
Isolated Labs
Malware Testing
No Internet
Bridged Network
Production-like Testing
Visible on LAN
IP Address Planning
Controller
192.168.100.10
Ubuntu
192.168.100.20
192.168.100.21
Rocky
192.168.100.30
AlmaLinux
192.168.100.31
Debian
192.168.100.40
Enterprise Guidelines
Leave numbering gaps
Reserve future IP ranges
Document assignments
Create Controller VM
VMware
Create New VM
Typical Installation
Select Ubuntu ISO
Configuration
Name
ansible-controller
CPU
2
RAM
4096 MB
Disk
40 GB
Network
NAT
Create Managed Nodes
Ubuntu01
Ubuntu02
Rocky01
Alma01
Debian01
Configuration
CPU
1
RAM
2048 MB
Disk
20 GB
Network
NAT
Operating System Installation
Ubuntu
Install Ubuntu Server
English
DHCP
Entire Disk
Install OpenSSH
Debian
Minimal Install
OpenSSH
Rocky Linux
Minimal Installation
OpenSSH
AlmaLinux
Minimal Installation
OpenSSH
Enterprise Best Practices
Minimal Packages
Disable GUI
Consistent Username
Strong Passwords
Static IP Configuration
Why Static IP
Prevent inventory failures
Stable automation
Easier troubleshooting
Ubuntu Debian
Netplan
Commands
sudo nano /etc/netplan/*.yaml
sudo netplan generate
sudo netplan apply
Verification
ip addr
ip route
Rocky AlmaLinux
NetworkManager
nmcli
Commands
nmcli connection show
nmcli connection modify
nmcli connection up
Verification
ip addr
ip route
Hostname Configuration
Commands
sudo hostnamectl set-hostname ansible-controller
sudo hostnamectl set-hostname ubuntu01
sudo hostnamectl set-hostname rocky01
sudo hostnamectl set-hostname alma01
sudo hostnamectl set-hostname debian01
Verification
hostname
hostnamectl
Enterprise Naming Standards
Environment
Location
Function
Numbering
Example
prod-web-01
dev-db-01
ansible-controller
Local DNS Resolution
File
/etc/hosts
Entries
Controller
Ubuntu
Debian
Rocky
Alma
Commands
sudo nano /etc/hosts
Verify
ping hostname
Enterprise Note
Temporary solution
Production uses DNS
Network Verification
Check IP
ip addr
Check Gateway
ip route
Check DNS
cat /etc/resolv.conf
Test Internet
ping 8.8.8.8
Test DNS
ping google.com
Test Hostname
ping ubuntu01
SSH Verification
Install
sudo apt install openssh-server
sudo dnf install openssh-server
Enable
sudo systemctl enable ssh
sudo systemctl enable sshd
Start
sudo systemctl start ssh
sudo systemctl start sshd
Verify
systemctl status ssh
systemctl status sshd
Test Login
ssh
bilal@192.168.100.20
First Login
Accept fingerprint
Verify known_hosts
System Updates
Ubuntu Debian
sudo apt update
sudo apt upgrade -y
Rocky AlmaLinux
sudo dnf update -y
Reboot
sudo reboot
Enterprise Best Practices
Use Static IPs
Minimal Installations
Strong Password Policy
Consistent Usernames
Enable SSH Keys
Snapshot Before Changes
Use Version Control
Separate Controller
Disable Root SSH Login
Keep Systems Updated
Least Privilege
Inventory Documentation
Troubleshooting
Cannot Ping
Firewall
Wrong Gateway
Wrong IP
Network Adapter
No Internet
NAT Misconfiguration
DNS Failure
Gateway Incorrect
SSH Failure
SSH Service Down
Firewall Port 22
Wrong Credentials
Hostname Failure
Incorrect /etc/hosts
DNS Issues
Static IP Failure
YAML Syntax Error
Wrong Interface Name
Duplicate IP
Enterprise Security
Disable Root Login
PermitRootLogin no
Password Authentication
Prefer SSH Keys
Firewall
Allow SSH
Restrict Access
Time Synchronization
chronyd
systemd-timesyncd
Logging
journalctl
rsyslog
Enterprise Implementation Flow
Build Infrastructure
↓
Verify Network
↓
Configure SSH
↓
Configure Static IP
↓
Configure Hostnames
↓
Update Systems
↓
Install Ansible
↓
Configure Inventory
↓
Test Connectivity
↓
Deploy Patch Automation
↓
Integrate Wazuh
↓
Integrate ELK
↓
Deploy AWX
↓
Enterprise Patch Management
Common Interview Questions
Why use a dedicated Ansible Controller?
Centralized automation
Better security
Easier management
Why use Static IP?
Stable inventory
Predictable automation
Why SSH?
Secure encrypted communication
Agentless automation
Why minimal installation?
Reduced attack surface
Lower resource usage
Easier maintenance
Why configure hostnames?
Easier identification
Better logging
Inventory readability
Why edit /etc/hosts?
Local name resolution
Lab environments
DNS-independent testing
Why install OpenSSH?
Required for Ansible
Why NAT instead of Host-only?
Internet access
Package installation
Repository connectivity
Difference between NAT, Bridged and Host-only
NAT
Internet through host
Bridged
Direct LAN access
Host-only
Isolated environment
Why update immediately after installation?
Security patches
Bug fixes
Stable environment
What are prerequisites before installing Ansible?
SSH
Static IP
DNS
Updated systems
Hostname configuration
Phase 1 Success Checklist
VMware Installed
BIOS Virtualization Enabled
ISO Repository Ready
Virtual Network Configured
Controller Installed
Target Servers Installed
Static IP Configured
Hostnames Configured
/etc/hosts Configured
Internet Working
DNS Working
Ping Successful
SSH Successful
Systems Updated
Ready for Phase 2 (Ansible Installation)