Setting up authentication for Linux remediation in Concert

Edit online

Use this topic to configure authentication for Linux® patch remediation. The authentication you configure here is referenced as the linux_auth input when running the Remediation_Master workflow in IBM® Concert.

Before you begin

Ensure that:

  • The target Linux VMs are accessible through SSH.
  • You have an SSH private key with sudo privileges on the target VMs.
  • You have access to the Concert UI and permission to create authentication entries and ConfigData.
  • Set up the Sync AWS Linux Bulletin Workflow to populate the latest Amazon-Linux vulnerability data. For instructions, see Setting up the Sync AWS Linux Bulletin Workflow.

Step 1: Create the Ansible authentication

To run patching through Ansible, you must configure a Concert authentication that includes the following inputs.
  1. Private key (in JSON format)
    Create a JSON object where each key name matches the filenames used in your Ansible inventory. 
    {
  "redhat-patch.b64": "<base64-encoded-value-of-id_rsa>",
  "linux-test.b64": "<base64-encoded-value-of-id_rsa>"
}
    You can generate the base64 value using: 
    base64 -w 0 ~/.ssh/id_rsa
  2. Inventory file (in Ansible hosts format) 
    [canary]
9.46.239.156 ansible_host=redhat-linux-patch1.fyre.ibm.com ansible_user=root ansible_ssh_private_key_file=redhat-patch.b64
9.30.123.9 ansible_host=linux-patch-test1.fyre.ibm.com ansible_user=root ansible_ssh_private_key_file=linux-test.b64
  • The ansible_ssh_private_key_file value must match the key name used in your private key JSON.
  • Ensure consistency in key naming across both inventory and key file entries.
Figure 1. Authentication setup for Ansible patchingScreenshot of Authentication setup for Ansible patching.

Step 2: Create a ConfigData Auth for Linux patching

Create a JSON structure that maps each Linux host IP to a corresponding Concert authentication entry. For example: 
{
  "config": [
    {
      "auth": "ibmconcert/inux_patch_auth1",
      "host": ["<host_ip_1>"]
    },
    {
      "auth": "ibmconcert/inux_patch_auth1",
      "host": ["<host_ip_2>", "<host_ip_3>"]
    }
  ]
}
  • Each auth field must reference a valid authentication entry configured in Concert.
  • You can group multiple host IPs under a single auth.
Figure 2. ConfigData Auth entry for LinuxScreenshot of ConfigData Auth entry for Linux.