3. Installation Notes¶

3.1. Flags and extra vars passed with Tower¶

Flags and/or extra variables that you can use with the Ansible Tower installer include (but are not limited to) the following:

Usage: setup.sh [Options] [-- Ansible Options]
Options:
        -i INVENTORY_FILE     Path to ansible inventory file (default: ${INVENTORY_FILE})
        -e EXTRA_VARS         Set additional ansible variables as key=value or YAML/JSON
                                i.e. -e bundle_install=false will force an online install
        -b                    Perform a database backup in lieu of installing.
        -r                    Perform a database restore in lieu of installing.
        -h                    Show this help message and exit
Ansible Options:
        Additional options to be passed to ansible-playbook can be added following the -- separator.

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_awesome=True -- -K

3.2. Installing Tower on Systems with FIPS Mode Enabled¶

Tower can run on systems where FIPS mode is enabled, though there are a few limitations to keep in mind:

• Only Enterprise Linux 7+ is supported. The standard python that ships with RHEL must be used for Ansible Tower to work in FIPS mode. Using any non-standard, non-system python for Tower is therefore, unsupported.

• By default, Tower configures PostgreSQL using password-based authentication, and this process relies on the usage of md5 when CREATE USER is run at install time. If you intend to run the Tower installer from a FIPS-enabled system, you’ll need to pre-compute an md5 hash yourself at install time and add its value to the inventory file described in Setting up the Inventory File.

  Specifically, you must pre-compute the hashed value on a system without FIPS enabled:

  $ python -c 'from hashlib import md5; print("md5" + md5("choose-a-password" + "awx").hexdigest())'
  md57d08dde7e95e862eaadfff09565e92e6
  

  …and specify both pg_password and pg_hashed_password in your inventory file:

  pg_password='choose-a-password'
  pg_hashed_password='md57d08dde7e95e862eaadfff09565e92e6'
  

  The “awx” implies the Postgres username. If you have an alternative username, provide that rather than “awx”.

• The ssh-keygen command generates keys in a format (RFC4716) which uses the md5 digest algorithm at some point in the process (as part of a transformation performed on the input passphrase). On a FIPS-enforcing system, md5 is completely disabled, so these types of encrypted SSH keys (RFC4716 private keys protected by a passphrase) will not be usable. When FIPS mode is enabled, any encrypted SSH key you import into Ansible Tower must be a PKCS8-formatted key. Existing AES128 keys can be converted to PKCS8 by running the following openssl command:

  $ openssl pkcs8 -topk8 -v2 aes128 -in <INPUT_KEY> -out <NEW_OUTPUT_KEY>
  

For more details, see: https://access.redhat.com/solutions/1519083

• Use of Ansible features that use the paramiko library will not be FIPS compliant. This includes setting ansible_connection=paramiko as a transport and using network modules that utilize the ncclient NETCONF library.

• The TACACS+ protocol uses md5 to obfuscate the content of authorization packets; TACACS+ Authentication is not supported for systems where FIPS mode is enabled.

• The RADIUS protocol uses md5 to encrypt passwords in Access-Request queries; RADIUS Authentication is not supported for systems where FIPS mode is enabled.

3.3. Notes for Red Hat Enterprise Linux and CentOS setups¶

• PackageKit can frequently interfere with the installation/update mechanism. Consider disabling or removing PackageKit if installed prior to running the setup process.

• Only the “targeted” SELinux policy is supported. The targeted policy can be set to disabled, permissive, or enforcing.

• When performing a bundled install (refer to Using the Bundled Tower Installation Program for more information), Red Hat Enterprise Linux customers must enable the following repositories which are disabled by default:

  • Red Hat Enterprise Linux 7 users must enable the extras repositories.

3.4. Configuration and Installation of Ansible with Red Hat Enterprise Linux and CentOS¶

The following steps help you configure access to the repository as well as install Ansible on older versions of Tower.

root@localhost:~$ yum install http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

root@localhost:~$ yum install ansible

3.5. Configuration and Installation of Ansible with Ubuntu¶

The following steps help you configure access to the repository as well as install Ansible on older versions of Tower.

root@localhost:~$ apt-get install software-properties-common
root@localhost:~$ apt-add-repository ppa:ansible/ansible

root@localhost:~$ apt-get update
root@localhost:~$ apt-get install ansible

3.6. Configuration and Installation on OpenShift¶

For OpenShift-based deployments, refer to OpenShift Deployment and Configuration.