DEV Community: Janak Shrestha

Day 59: Troubleshoot Deployment Issues in Kubernetes

Janak Shrestha — Sun, 30 Aug 2026 14:31:18 +0000

The Nautilus DevOps team is working on a Kubernetes template to deploy a web application on the cluster. There are some requirements to create/use persistent volumes to store the application code, and the template needs to be designed accordingly. Please find more details below:

Create a PersistentVolume named as pv-devops. Configure the spec as storage class should be manual, set capacity to 3Gi, set access mode to ReadWriteOnce, volume type should be hostPath and set path to /mnt/itadmin (this directory is already created, you might not be able to access it directly, so you need not to worry about it).
Create a PersistentVolumeClaim named as pvc-devops. Configure the spec as storage class should be manual, request 3Gi of the storage, set access mode to ReadWriteOnce.
Create a pod named as pod-devops, mount the persistent volume you created with claim name pvc-devops at document root of the web server, the container within the pod should be named as container-devops using image httpd with latest tag only (remember to mention the tag i.e httpd:latest).
Create a node port type service named web-devops using node port 30008 to expose the web server running within the pod.

Understanding Persistent Volumes and Claims

What is a Persistent Volume?

A Persistent Volume (PV) is a piece of storage in the cluster that has been provisioned by an administrator. It is a cluster resource, similar to a node, and is independent of any individual pod.

What is a Persistent Volume Claim?

A Persistent Volume Claim (PVC) is a request for storage by a user. It is similar to a pod in that a pod consumes node resources, while a PVC consumes PV resources.

The Relationship Between PV and PVC

┌─────────────────────────────────────────────────────────────────────────────┐
│                    Persistent Volume Workflow                              │
│                                                                              │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  Administrator: Creates PersistentVolume (PV)                        │ │
│  │  - Defines storage capacity                                          │ │
│  │  - Sets access modes                                                 │ │
│  │  - Specifies storage type (hostPath, NFS, etc.)                    │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                    │                                         │
│                                    ▼                                         │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  User: Creates PersistentVolumeClaim (PVC)                          │ │
│  │  - Requests storage capacity                                         │ │
│  │  - Specifies access modes                                            │ │
│  │  - Binds to a matching PV                                            │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                    │                                         │
│                                    ▼                                         │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  Pod: Uses PVC to mount storage                                     │ │
│  │  - References PVC in volumes section                                 │ │
│  │  - Mounts volume at specified path                                   │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘

What We Will Build

We are going to deploy a complete web application with persistent storage:

Component	Specification
PersistentVolume	`pv-devops` – 3Gi, manual storage class, hostPath
PersistentVolumeClaim	`pvc-devops` – 3Gi request
Pod	`pod-devops` – httpd web server
Service	`web-devops` – NodePort on 30008

Architecture Overview

┌─────────────────────────────────────────────────────────────────────────────┐
│                         Kubernetes Cluster                                 │
│                                                                              │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  PersistentVolume: pv-devops                                          │ │
│  │  - Capacity: 3Gi                                                     │ │
│  │  - Access Mode: ReadWriteOnce                                        │ │
│  │  - Storage Class: manual                                             │ │
│  │  - HostPath: /mnt/itadmin                                            │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                    │                                         │
│                                    ▼                                         │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  PersistentVolumeClaim: pvc-devops                                   │ │
│  │  - Requests: 3Gi                                                     │ │
│  │  - Access Mode: ReadWriteOnce                                        │ │
│  │  - Storage Class: manual                                             │ │
│  │  - Bound to: pv-devops                                               │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                    │                                         │
│                                    ▼                                         │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  Pod: pod-devops                                                      │ │
│  │  ┌──────────────────────────────────────────────────────────────────┐ │ │
│  │  │  Container: container-devops                                    │ │ │
│  │  │  Image: httpd:latest                                            │ │ │
│  │  │  Port: 80                                                       │ │ │
│  │  │  Volume: pvc-storage → pvc-devops                               │ │ │
│  │  │  Mount: /usr/local/apache2/htdocs                               │ │ │
│  │  └──────────────────────────────────────────────────────────────────┘ │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                    │                                         │
│                                    ▼                                         │
│  ┌────────────────────────────────────────────────────────────────────────┐ │
│  │  Service: web-devops                                                  │ │
│  │  - Type: NodePort                                                    │ │
│  │  - Selector: app=httpd                                               │ │
│  │  - Port: 80                                                          │ │
│  │  - NodePort: 30008                                                   │ │
│  └────────────────────────────────────────────────────────────────────────┘ │
│                                    │                                         │
│                                    ▼                                         │
│                    http://<node-ip>:30008                                  │
└─────────────────────────────────────────────────────────────────────────────┘

Step-by-Step Implementation

Step 1: Create the PersistentVolume

Create a file named pv-devops.yaml:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-devops
spec:
  storageClassName: manual
  capacity:
    storage: 3Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: /mnt/itadmin

Explanation:

storageClassName: manual – Identifies the storage class
capacity.storage: 3Gi – Allocates 3 gigabytes of storage
accessModes: ReadWriteOnce – Can be mounted as read-write by a single node
hostPath.path: /mnt/itadmin – Uses the host node's filesystem

Step 2: Create the PersistentVolumeClaim

Create a file named pvc-devops.yaml:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-devops
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Gi

Explanation:

The storageClassName must match the PV's storage class
The accessModes must match the PV's access modes
resources.requests.storage – Requests 3Gi of storage

Step 3: Create the Pod

Create a file named pod-devops.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-devops
  labels:
    app: httpd
spec:
  containers:
  - name: container-devops
    image: httpd:latest
    ports:
    - containerPort: 80
    volumeMounts:
    - name: pvc-storage
      mountPath: /usr/local/apache2/htdocs
  volumes:
  - name: pvc-storage
    persistentVolumeClaim:
      claimName: pvc-devops

Explanation:

labels.app: httpd – Used by the service for selection
volumeMounts.mountPath – The document root for httpd
persistentVolumeClaim.claimName – References the PVC

Step 4: Create the Service

Create a file named service-devops.yaml:

apiVersion: v1
kind: Service
metadata:
  name: web-devops
spec:
  type: NodePort
  selector:
    app: httpd
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30008

Explanation:

type: NodePort – Exposes the service on a static port
selector.app: httpd – Routes traffic to pods with this label
nodePort: 30008 – The port on each node

Step 5: Apply the Configurations

kubectl apply -f pv-devops.yaml
kubectl apply -f pvc-devops.yaml
kubectl apply -f pod-devops.yaml
kubectl apply -f service-devops.yaml

Output:

persistentvolume/pv-devops created
persistentvolumeclaim/pvc-devops created
pod/pod-devops created
service/web-devops created

Verification

Step 1: Verify the PersistentVolume

kubectl get pv

Output:

NAME        CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                STORAGECLASS
pv-devops   3Gi        RWO            Retain           Bound    default/pvc-devops   manual

Step 2: Verify the PersistentVolumeClaim

kubectl get pvc

Output:

NAME         STATUS   VOLUME      CAPACITY   ACCESS MODES   STORAGECLASS
pvc-devops   Bound    pv-devops   3Gi        RWO            manual

Step 3: Verify the Pod

kubectl get pods

Output:

NAME         READY   STATUS    RESTARTS   AGE
pod-devops   1/1     Running   0          84s

Step 4: Verify the Service

kubectl get services

Output:

NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.43.0.1      <none>        443/TCP        32m
web-devops   NodePort    10.43.193.63   <none>        80:30008/TCP   90s

Step 5: Verify the Endpoints

kubectl get endpoints web-devops

Output:

NAME         ENDPOINTS      AGE
web-devops   10.22.0.9:80   2m35s

Accessing the Application

The application can now be accessed at:

http://<node-ip>:30008

Default Httpd Page

When accessing the URL, you should see the default Apache HTTP Server welcome page, confirming that the web server is running and the persistent volume is mounted correctly.

Key Concepts

Access Modes

Access Mode	Description
`ReadWriteOnce` (RWO)	Volume can be mounted as read-write by a single node
`ReadOnlyMany` (ROX)	Volume can be mounted as read-only by many nodes
`ReadWriteMany` (RWX)	Volume can be mounted as read-write by many nodes

Storage Classes

Storage classes provide a way to define different types of storage:

manual – For manually provisioned storage
standard – For dynamically provisioned storage
Custom classes – For specific storage providers (AWS EBS, GCE PD, etc.)

Reclaim Policies

Policy	Description
`Retain`	Volume is retained after PVC deletion (manual cleanup required)
`Recycle`	Volume is scrubbed and made available again (deprecated)
`Delete`	Volume is deleted when PVC is deleted

HostPath Volume

hostPath mounts a directory from the host node's filesystem. This is useful for:

Development and testing
Accessing host system files
Single-node clusters

For production environments, consider using network-attached storage like NFS, or cloud provider storage solutions.

Troubleshooting

PVC Stuck in Pending State

# Check the PVC status
kubectl get pvc

# View detailed PVC information
kubectl describe pvc pvc-devops

# Check for available PVs
kubectl get pv

# Verify storage class and access modes match

Pod Fails to Start

# Check pod status
kubectl get pods

# View pod details
kubectl describe pod pod-devops

# Check pod logs
kubectl logs pod-devops

Service Not Accessible

# Check service status
kubectl get services

# Check endpoints
kubectl get endpoints web-devops

# Verify NodePort
kubectl get service web-devops -o yaml | grep nodePort

Best Practices

1. Use Appropriate Storage Classes

Choose the right storage class for your workload:

manual – For testing and development
standard – For production with dynamic provisioning
Custom classes – For specific performance or availability requirements

2. Set Resource Requests

Always set appropriate storage requests:

Request only what you need
Monitor usage to adjust requests

3. Use Reclaim Policies Wisely

Retain – For important data that should not be accidentally deleted
Delete – For temporary or disposable data

4. Consider PersistentVolume Snapshots

For production workloads, consider using volume snapshots for backup and disaster recovery.

5. Monitor Storage Usage

Use monitoring tools to track storage usage and capacity.

Summary

In this challenge, we successfully:

Created a PersistentVolume with 3Gi capacity, hostPath storage, and manual storage class
Created a PersistentVolumeClaim requesting 3Gi of storage
Deployed a pod running the httpd web server with the PVC mounted at the document root
Exposed the application using a NodePort service on port 30008

This deployment pattern is foundational for stateful applications in Kubernetes. Understanding how to manage persistent storage is essential for running production workloads like databases, content management systems, and any application that requires data persistence.

Useful Commands Reference

Command	Purpose
`kubectl get pv`	List all PersistentVolumes
`kubectl get pvc`	List all PersistentVolumeClaims
`kubectl describe pv pv-devops`	Detailed PV information
`kubectl describe pvc pvc-devops`	Detailed PVC information
`kubectl get pods --show-labels`	List pods with labels
`kubectl get endpoints web-devops`	Check service endpoints
`kubectl describe service web-devops`	Detailed service information
`kubectl logs pod-devops`	View pod logs
`kubectl get nodes -o wide`	Get node IP addresses

Day 59: Troubleshoot Deployment Issues in Kubernetes

Janak Shrestha — Sun, 30 Aug 2026 14:11:41 +0000

Last week, the Nautilus DevOps team deployed a redis app on Kubernetes cluster, which was working fine so far. This morning one of the team members was making some changes in this existing setup, but he made some mistakes and the app went down. We need to fix this as soon as possible. Please take a look.

The deployment name is redis-deployment. The pods are not in running state right now, so please look into the issue and fix the same.

Step 1: Identify the Issue

kubectl get deployments
kubectl get pods
kubectl describe deployment redis-deployment

Issues Found:

Pod stuck in ContainerCreating status
Image: redis:alpin (invalid, should be redis:alpine)
ConfigMap: redis-conig (misspelled, should be redis-config)

Step 2: Delete the Faulty Deployment

kubectl delete deployment redis-deployment

Step 3: Create Corrected YAML

cat > redis-deployment-fixed.yaml << 'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-deployment
  labels:
    app: redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - name: redis-container
        image: redis:alpine
        ports:
        - containerPort: 6379
        resources:
          requests:
            cpu: 300m
        volumeMounts:
        - mountPath: /redis-master-data
          name: data
        - mountPath: /redis-master
          name: config
      volumes:
      - name: data
        emptyDir: {}
      - name: config
        configMap:
          name: redis-config
EOF

Step 4: Apply the Corrected Deployment

kubectl apply -f redis-deployment-fixed.yaml

Step 5: Verify the Fix

kubectl get deployments

Output:

NAME               READY   UP-TO-DATE   AVAILABLE   AGE
redis-deployment   1/1     1            1           31s

kubectl get pods

Output:

NAME                                READY   STATUS    RESTARTS   AGE
redis-deployment-5476b4ddd6-f7txp   1/1     Running   0          31s

Key Learnings

Common Issues and Fixes

Issue	Symptom	Fix
Invalid image name	`ContainerCreating`	Use correct image name and tag
Misspelled ConfigMap	`ContainerCreating`	Match ConfigMap name exactly
Missing ConfigMap	`ContainerCreating`	Create the ConfigMap
Resource limits	`Pending` or `CrashLoopBackOff`	Adjust resource requests/limits

Troubleshooting Commands

Command	Purpose
`kubectl get deployments`	Check deployment status
`kubectl get pods`	Check pod status
`kubectl describe deployment <name>`	Detailed deployment info
`kubectl describe pod <name>`	Detailed pod info
`kubectl logs <pod-name>`	View pod logs
`kubectl get events`	View cluster events
`kubectl rollout status deployment <name>`	Check rollout status

Ansible Blockinfile Module

Janak Shrestha — Sun, 30 Aug 2026 13:59:39 +0000

The Nautilus DevOps team wants to install and set up a simple httpd web server on all app servers in Stratos DC. Additionally, they want to deploy a sample web page for now using Ansible only. Therefore, write the required playbook to complete this task. Find more details about the task below.

We already have an inventory file under /home/thor/ansible directory on jump host. Create a playbook.yml under /home/thor/ansible directory on jump host itself.

Using the playbook, install httpd web server on all app servers. Additionally, make sure its service should up and running.
Using blockinfile Ansible module add some content in /var/www/html/index.html file. Below is the content:

Welcome to XfusionCorp!

This is Nautilus sample file, created using Ansible!

Please do not modify this file manually!
The /var/www/html/index.html file's user and group owner should be apache on all app servers.
The /var/www/html/index.html file's permissions should be 0644 on all app servers.

Note:

i. Validation will try to run the playbook using command ansible-playbook -i inventory playbook.yml so please make sure the playbook works this way without passing any extra arguments.

ii. Do not use any custom or empty marker for blockinfile module.

📋 Introduction

In the world of DevOps, automation is the cornerstone of efficiency and consistency. The Nautilus DevOps team recently needed to deploy a simple HTTPD web server across all application servers in the Stratos DC with a sample web page. Instead of manually configuring each server, we leveraged Ansible's powerful automation capabilities—specifically the blockinfile module—to complete this task seamlessly.

This blog post documents the complete process, from understanding the requirements to successful deployment and verification.

🎯 The Challenge

The team had specific requirements for all application servers:

Component	Requirement
Web Server	HTTPD (Apache) installed
Service Status	Running and enabled on boot
Web Page Location	`/var/www/html/index.html`
Content	Specific welcome message
File Owner	apache:apache
File Permissions	0644 (rw-r--r--)
Content Module	blockinfile with default markers

Content to Deploy

Welcome to XfusionCorp!

This is  Nautilus sample file, created using Ansible!

Please do not modify this file manually!

🛠️ The Solution: Ansible Playbook

Complete Playbook

---
- name: Deploy HTTPD web server with sample page
  hosts: all
  gather_facts: yes

  tasks:
    # Task 1: Install httpd web server
    - name: Install httpd web server
      package:
        name: httpd
        state: present
      become: yes

    # Task 2: Start and enable httpd service
    - name: Start and enable httpd service
      service:
        name: httpd
        state: started
        enabled: yes
      become: yes

    # Task 3: Create web root directory
    - name: Create web root directory
      file:
        path: /var/www/html
        state: directory
        mode: '0755'
        owner: apache
        group: apache
      become: yes

    # Task 4: Add content using blockinfile module
    - name: Add content to index.html using blockinfile
      blockinfile:
        path: /var/www/html/index.html
        block: |
          Welcome to XfusionCorp!

          This is  Nautilus sample file, created using Ansible!

          Please do not modify this file manually!
        create: yes
        owner: apache
        group: apache
        mode: '0644'
        state: present
      become: yes

Playbook Breakdown

1. Package Installation

- name: Install httpd web server
  package:
    name: httpd
    state: present
  become: yes

Uses the package module to install HTTPD. The package module intelligently chooses the appropriate package manager (yum, apt, etc.) based on the target system.

2. Service Management

- name: Start and enable httpd service
  service:
    name: httpd
    state: started
    enabled: yes
  become: yes

Ensures the HTTPD service is both running (state: started) and configured to start automatically on boot (enabled: yes).

3. Web Root Directory Setup

- name: Create web root directory
  file:
    path: /var/www/html
    state: directory
    mode: '0755'
    owner: apache
    group: apache
  become: yes

Creates the web root directory with proper permissions and ownership.

4. Content Management with Blockinfile

- name: Add content to index.html using blockinfile
  blockinfile:
    path: /var/www/html/index.html
    block: |
      Welcome to XfusionCorp!

      This is  Nautilus sample file, created using Ansible!

      Please do not modify this file manually!
    create: yes
    owner: apache
    group: apache
    mode: '0644'
    state: present
  become: yes

The blockinfile module:

Inserts a block of text into a file
Uses default markers (# BEGIN ANSIBLE MANAGED BLOCK and # END ANSIBLE MANAGED BLOCK)
Creates the file if it doesn't exist (create: yes)
Sets ownership and permissions in one task
Is idempotent—won't duplicate content if re-run

🚀 Execution and Results

Running the Playbook

cd /home/thor/ansible
ansible-playbook -i inventory playbook.yml

Successful Output

PLAY [Deploy HTTPD web server with sample page] *********************************

TASK [Gathering Facts] **********************************************************
ok: [stapp01]
ok: [stapp02]
ok: [stapp03]

TASK [Install httpd web server] *************************************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

TASK [Start and enable httpd service] *******************************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

TASK [Create web root directory] ************************************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

TASK [Add content to index.html using blockinfile] *****************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

PLAY RECAP *********************************************************************
stapp01 : ok=5 changed=4 unreachable=0 failed=0 skipped=0
stapp02 : ok=5 changed=4 unreachable=0 failed=0 skipped=0
stapp03 : ok=5 changed=4 unreachable=0 failed=0 skipped=0

🔍 Verification

File Existence and Permissions

$ ansible -i inventory all -m shell -a "ls -la /var/www/html/index.html" --become

stapp01 | CHANGED | rc=0 >>
-rw-r--r-- 1 apache apache 179 Aug 30 13:55 /var/www/html/index.html

stapp02 | CHANGED | rc=0 >>
-rw-r--r-- 1 apache apache 179 Aug 30 13:55 /var/www/html/index.html

stapp03 | CHANGED | rc=0 >>
-rw-r--r-- 1 apache apache 179 Aug 30 13:55 /var/www/html/index.html

✅ Permissions: 0644 (rw-r--r--)
✅ Owner: apache:apache

File Content with Markers

$ ansible -i inventory all -m shell -a "cat /var/www/html/index.html" --become

stapp01 | CHANGED | rc=0 >>
# BEGIN ANSIBLE MANAGED BLOCK
Welcome to XfusionCorp!

This is  Nautilus sample file, created using Ansible!

Please do not modify this file manually!
# END ANSIBLE MANAGED BLOCK

✅ Content: Matches requirements exactly
✅ Markers: Default markers added automatically by blockinfile

Service Status

$ ansible -i inventory all -m shell -a "systemctl status httpd" --become

stapp01 | CHANGED | rc=0 >>
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled)
   Active: active (running) since Sun 2026-08-30 13:55:49 UTC

✅ Service: Active (running)
✅ Enabled: Boot startup configured

📊 Comparison: Before vs After

Aspect	Before	After
HTTPD Installed	❌ Not installed	✅ Installed on all servers
Service Running	❌ Not running	✅ Active and running
Web Root Directory	❌ Not present	✅ Created with correct permissions
index.html	❌ Missing	✅ Created with correct content
File Owner	N/A	✅ apache:apache
File Permissions	N/A	✅ 0644
Content Markers	N/A	✅ Default markers present

💡 Key Learnings

1. The Power of Blockinfile

The blockinfile module is perfect for managing configuration files or content blocks. Key benefits:

Idempotent: Safe to run multiple times
Default Markers: Provides clear boundaries for managed content
Single Task: Handles creation, content insertion, and permissions in one go

2. Idempotency in Action

Running the playbook multiple times won't cause issues:

First Run: Creates everything (changed=4)
Second Run: Verifies everything (ok=5, changed=0)

3. Host Pattern Flexibility

Using hosts: all ensures the playbook works regardless of inventory group structure.

4. Service State Management

Combining state: started and enabled: yes ensures both immediate availability and persistence across reboots.

📋 Complete Verification Commands

# Check file exists and permissions
ansible -i inventory all -m shell -a "ls -la /var/www/html/index.html" --become

# Check content with markers
ansible -i inventory all -m shell -a "cat /var/www/html/index.html" --become

# Check ownership
ansible -i inventory all -m shell -a "stat -c '%U:%G' /var/www/html/index.html" --become

# Check permissions
ansible -i inventory all -m shell -a "stat -c '%a' /var/www/html/index.html" --become

# Check service status
ansible -i inventory all -m shell -a "systemctl status httpd" --become

# Test web server response
ansible -i inventory all -m shell -a "curl -s http://localhost/ | head -3" --become

🎉 Conclusion

The Ansible playbook successfully automated the HTTPD web server deployment across all application servers with:

✅ Simple Setup: Just one playbook file
✅ Consistent Results: Same configuration on all servers
✅ Proper Permissions: apache:apache ownership with 0644 permissions
✅ Correct Content: The exact message with default markers
✅ Service Management: Running and enabled on boot
✅ Idempotency: Safe to run multiple times

Business Benefits

Time Savings: Automated what would be a 15-minute manual task per server
Consistency: No configuration drift between servers
Reliability: Idempotent execution ensures predictable results
Maintainability: Easy to update content or configuration
Documentation: Playbook serves as living documentation

Next Steps

Add SSL/TLS Configuration for secure connections
Implement Virtual Hosts for multiple websites
Add Health Checks for monitoring
Integrate with CI/CD for automated deployments
Add Content Security Policies

📚 Resources

Ansible Blockinfile Module: Documentation
Ansible Service Module: Documentation
Ansible File Module: Documentation
HTTPD/Apache Documentation: Apache HTTP Server

"Automation is not about eliminating human effort, but about maximizing human potential." 🚀

Ansible Unarchive Module

Janak Shrestha — Sun, 30 Aug 2026 13:16:42 +0000

One of the DevOps team members has created a zip archive on jump host in Stratos DC that needs to be extracted and copied over to all app servers in Stratos DC itself. Because this is a routine task, the Nautilus DevOps team has suggested automating it. We can use Ansible since we have been using it for other automation tasks. Below you can find more details about the task:

We have an inventory file under /home/thor/ansible directory on jump host, which should have all the app servers added already.

There is a zip archive /usr/src/data/datacenter.zip on jump host.

Create a playbook.yml under /home/thor/ansible/ directory on jump host itself to perform the below given tasks.

Unzip /usr/src/data/datacenter.zip archive in /opt/data/ location on all app servers.
Make sure the extracted data must has the respective sudo user as their user and group owner, i.e tony for app server 1, steve for app server 2, banner for app server 3.
The extracted data permissions must be 0655.

Note: Validation will try to run the playbook using command ansible-playbook -i inventory playbook.yml so please make sure playbook works this way, without passing any extra arguments.

🚀 Introduction

In the world of DevOps, managing files across multiple servers is a routine but critical task. Whether you're deploying applications, backing up data, or distributing configuration files, the ability to efficiently compress, transfer, and extract files is essential. Ansible, the powerful automation tool, provides two specialized modules—archive and unarchive—that make these operations seamless and reliable.

This comprehensive guide covers everything you need to know about Ansible's archive and unarchive modules, including:

Module Deep Dives: Understanding archive and unarchive in detail
Inventory Best Practices: Creating robust inventory files
Playbook Design: Building production-ready playbooks
Real-World Examples: Complete working examples from actual tasks
Troubleshooting: Common issues and their solutions
Security Best Practices: Protecting sensitive data
Performance Optimization: Tips for faster execution

📚 Table of Contents

Understanding the Modules
Inventory File Best Practices
The Archive Module: Creating Archives
The Unarchive Module: Extracting Archives
Real-World Implementation
Verification and Testing
Troubleshooting Guide
Security Best Practices
Performance Optimization
Conclusion

1. Understanding the Modules

📦 The Archive Module

The archive module creates compressed archives of files and directories on target hosts.

Key Features:

Supports multiple formats: tar, gz, bz2, zip
Preserves file permissions and ownership
Can remove original files after archiving
Idempotent - skips if archive already exists with correct content

Basic Syntax:

- name: Create a tar.gz archive
  archive:
    path: /path/to/source/directory/
    dest: /path/to/archive.tar.gz
    format: gz
    force_archive: yes
    owner: username
    group: groupname
    mode: '0644'

📂 The Unarchive Module

The unarchive module extracts archives on target hosts.

Key Features:

Supports multiple formats: tar, gz, bz2, zip
Can extract from local or remote sources
Handles absolute/relative paths intelligently
Idempotent - skips if already extracted

Basic Syntax:

- name: Extract a zip archive
  unarchive:
    src: /path/to/source/archive.zip
    dest: /path/to/destination/
    remote_src: no
    owner: username
    group: groupname
    mode: '0644'

2. Inventory File Best Practices

📋 Creating the Perfect Inventory

A well-structured inventory file is the foundation of successful Ansible automation.

Basic Inventory Structure

[app_servers]
stapp01 ansible_host=stapp01 ansible_user=tony ansible_ssh_pass=Ir0nM@n
stapp02 ansible_host=stapp02 ansible_user=steve ansible_ssh_pass=Am3ric@
stapp03 ansible_host=stapp03 ansible_user=banner ansible_ssh_pass=BigGr33n

Production-Ready Inventory

# Group: Application Servers
[app_servers]
stapp01 ansible_host=stapp01 ansible_user=tony
stapp02 ansible_host=stapp02 ansible_user=steve
stapp03 ansible_host=stapp03 ansible_user=banner

# Group-specific variables
[app_servers:vars]
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
ansible_ssh_private_key_file=/home/thor/.ssh/id_rsa
ansible_python_interpreter=/usr/bin/python3

# Windows Server Group Example
[windows_servers]
db1 ansible_host=server4.company.com ansible_user=administrator

[windows_servers:vars]
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
ansible_password=Dbp@ss123!

Advanced Inventory with YAML Format

all:
  children:
    app_servers:
      hosts:
        stapp01:
          ansible_host: stapp01
          ansible_user: tony
        stapp02:
          ansible_host: stapp02
          ansible_user: steve
        stapp03:
          ansible_host: stapp03
          ansible_user: banner
      vars:
        ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
        ansible_ssh_private_key_file: /home/thor/.ssh/id_rsa

🔑 Security Best Practices for Inventory

1. Use SSH Keys Instead of Passwords

# Generate SSH key
ssh-keygen -t rsa -b 4096 -C "thor@jump-host"

# Copy to servers
ssh-copy-id tony@stapp01
ssh-copy-id steve@stapp02
ssh-copy-id banner@stapp03

# Inventory without passwords
stapp01 ansible_host=stapp01 ansible_user=tony
stapp02 ansible_host=stapp02 ansible_user=steve
stapp03 ansible_host=stapp03 ansible_user=banner

2. Use Ansible Vault for Secrets

# Create a vault file for passwords
ansible-vault create group_vars/all/vault.yml

# Content of vault.yml
---
vault_ssh_pass: "Ir0nM@n"
vault_sudo_pass: "Ir0nM@n"

# Inventory referencing vault
stapp01 ansible_host=stapp01 ansible_user=tony ansible_ssh_pass={{ vault_ssh_pass }}

3. Use Separate Variable Files

ansible/
├── inventory/
│   └── production
├── group_vars/
│   └── app_servers.yml
└── host_vars/
    ├── stapp01.yml
    ├── stapp02.yml
    └── stapp03.yml

3. The Archive Module: Creating Archives

📦 Complete Guide to Archive Module

Example 1: Create Simple Tar Archive

---
- name: Create archive examples
  hosts: app_servers
  gather_facts: no
  tasks:
    - name: Create tar.gz of /usr/src/data
      archive:
        path: /usr/src/data/
        dest: /opt/backup/data_backup.tar.gz
        format: gz
        force_archive: yes
      become: yes

Example 2: Create Zip Archive with Specific Permissions

---
- name: Create zip archive with permissions
  hosts: app_servers
  gather_facts: no
  tasks:
    - name: Create zip archive
      archive:
        path: /usr/src/itadmin/
        dest: /opt/itadmin/beta.zip
        format: zip
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
        force_archive: yes
      become: yes

Example 3: Archive with Multiple Paths

---
- name: Archive multiple directories
  hosts: app_servers
  gather_facts: no
  vars:
    archive_files:
      - /var/log/app
      - /etc/nginx
      - /usr/src/data
  tasks:
    - name: Create archive from multiple directories
      archive:
        path: "{{ archive_files }}"
        dest: /opt/backup/full_backup.tar.gz
        format: gz
        remove: no
      become: yes

Example 4: Advanced Archive with Error Handling

---
- name: Production-ready archive creation
  hosts: app_servers
  gather_facts: no
  vars:
    source_dirs:
      - /usr/src/data
      - /etc/config
    dest_dir: /opt/backup
    archive_name: "backup_{{ ansible_date_time.date }}.tar.gz"
    archive_path: "/opt/backup/backup_{{ ansible_date_time.date }}.tar.gz"

  tasks:
    - name: Create backup directory
      file:
        path: "{{ dest_dir }}"
        state: directory
        mode: '0755'
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
      become: yes

    - name: Check source directories exist
      stat:
        path: "{{ item }}"
      register: dir_stats
      with_items: "{{ source_dirs }}"
      become: yes
      failed_when: not item.stat.exists

    - name: Create archive of all source directories
      archive:
        path: "{{ source_dirs }}"
        dest: "{{ archive_path }}"
        format: gz
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
        force_archive: yes
      become: yes
      register: archive_result

    - name: Verify archive created
      stat:
        path: "{{ archive_path }}"
      register: archive_stat
      become: yes

    - name: Get archive size
      command: "du -sh {{ archive_path }}"
      register: archive_size
      become: yes
      changed_when: false

    - name: Display archive details
      debug:
        msg:
          - "✅ Archive created successfully on {{ inventory_hostname }}"
          - "📁 Source: {{ source_dirs | join(', ') }}"
          - "📦 Destination: {{ archive_path }}"
          - "📊 Size: {{ archive_size.stdout }}"
          - "👤 Owner: {{ ansible_user }}"

4. The Unarchive Module: Extracting Archives

📂 Complete Guide to Unarchive Module

Example 1: Extract from Jump Host to Remote Servers

---
- name: Extract zip archive from jump host
  hosts: app_servers
  gather_facts: no
  vars:
    source_archive: /usr/src/data/datacenter.zip
    dest_dir: /opt/data

  tasks:
    - name: Verify source archive exists
      local_action:
        module: stat
        path: "{{ source_archive }}"
      register: archive_stat
      run_once: yes
      failed_when: not archive_stat.stat.exists

    - name: Extract archive to destination
      unarchive:
        src: "{{ source_archive }}"
        dest: "{{ dest_dir }}"
        remote_src: no
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0655'
      become: yes

Example 2: Extract Remote Archive

---
- name: Extract remote archive
  hosts: app_servers
  gather_facts: no
  vars:
    archive_path: /tmp/datacenter.zip
    dest_dir: /opt/data

  tasks:
    - name: Extract archive (already on remote)
      unarchive:
        src: "{{ archive_path }}"
        dest: "{{ dest_dir }}"
        remote_src: yes
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0655'
      become: yes

Example 3: Extract with Additional Options

---
- name: Advanced unarchive with options
  hosts: app_servers
  gather_facts: no
  vars:
    source_archive: /usr/src/data/config.tar.gz
    dest_dir: /opt/config

  tasks:
    - name: Ensure unzip/tar is installed
      package:
        name:
          - unzip
          - tar
        state: present
      become: yes

    - name: Create destination directory
      file:
        path: "{{ dest_dir }}"
        state: directory
        mode: '0755'
      become: yes

    - name: Extract archive with specific parameters
      unarchive:
        src: "{{ source_archive }}"
        dest: "{{ dest_dir }}"
        remote_src: no
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
        extra_opts: [--strip-components=1]
        list_files: yes
      become: yes
      register: extract_result

    - name: Display extracted files
      debug:
        msg: "Extracted files: {{ extract_result.files }}"

Example 4: Complete Production Unarchive Playbook

---
- name: Production-ready archive extraction
  hosts: app_servers
  gather_facts: yes
  vars:
    source_archive: /usr/src/data/datacenter.zip
    dest_dir: /opt/data
    temp_dir: /tmp/ansible_extract

  tasks:
    # Pre-flight checks
    - name: Verify source archive exists on controller
      local_action:
        module: stat
        path: "{{ source_archive }}"
      register: archive_stat
      run_once: yes
      failed_when: not archive_stat.stat.exists

    - name: Display archive information
      debug:
        msg:
          - "📦 Archive: {{ source_archive }}"
          - "📊 Size: {{ (archive_stat.stat.size / 1024) | int }} KB"
          - "📅 Modified: {{ archive_stat.stat.mtime }}"
      run_once: yes

    # Dependencies
    - name: Ensure required packages are installed
      package:
        name:
          - unzip
          - tar
          - gzip
        state: present
      become: yes

    # Directory setup
    - name: Create destination directory
      file:
        path: "{{ dest_dir }}"
        state: directory
        mode: '0755'
      become: yes

    # Archive copy and extraction
    - name: Copy archive to remote host
      copy:
        src: "{{ source_archive }}"
        dest: "{{ temp_dir }}/{{ source_archive | basename }}"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
      become: yes

    - name: Extract archive
      unarchive:
        src: "{{ temp_dir }}/{{ source_archive | basename }}"
        dest: "{{ dest_dir }}"
        remote_src: yes
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0655'
        list_files: yes
      become: yes
      register: extract_result

    # Cleanup
    - name: Remove temporary archive
      file:
        path: "{{ temp_dir }}"
        state: absent
      become: yes

    # Verification
    - name: Verify extraction
      shell: "find {{ dest_dir }} -type f | wc -l"
      register: file_count
      become: yes
      changed_when: false

    - name: Verify correct ownership
      shell: "find {{ dest_dir }} -type f -user {{ ansible_user }} -group {{ ansible_user }} | wc -l"
      register: owner_count
      become: yes
      changed_when: false

    - name: Verify permissions
      shell: "find {{ dest_dir }} -type f -perm 0655 | wc -l"
      register: perm_count
      become: yes
      changed_when: false

    # Results
    - name: Display extraction summary
      debug:
        msg:
          - "✅ Extraction completed on {{ inventory_hostname }}"
          - "📁 Destination: {{ dest_dir }}"
          - "📄 Total files: {{ file_count.stdout }}"
          - "👤 Correct owner: {{ owner_count.stdout }} files"
          - "🔒 Correct permissions: {{ perm_count.stdout }} files"
          - "👤 Owner: {{ ansible_user }}"

5. Real-World Implementation

🏢 Complete Task Example: Data Center Archive Management

This section combines both archive and unarchive modules in a complete, real-world scenario.

Project Structure

ansible/
├── inventory
├── playbook_archive.yml
├── playbook_unarchive.yml
├── group_vars/
│   └── app_servers.yml
├── host_vars/
│   ├── stapp01.yml
│   ├── stapp02.yml
│   └── stapp03.yml
└── roles/
    └── archive_manager/
        ├── tasks/
        │   ├── main.yml
        │   ├── create_archive.yml
        │   └── extract_archive.yml
        └── vars/
            └── main.yml

Inventory File (Production)

# /home/thor/ansible/inventory

[app_servers]
stapp01 ansible_host=stapp01 ansible_user=tony
stapp02 ansible_host=stapp02 ansible_user=steve
stapp03 ansible_host=stapp03 ansible_user=banner

[app_servers:vars]
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
ansible_python_interpreter=/usr/bin/python3
ansible_ssh_private_key_file=/home/thor/.ssh/id_rsa

# Windows Servers (if needed)
[db_servers]
db1 ansible_host=server4.company.com ansible_user=administrator

[db_servers:vars]
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
ansible_password=Dbp@ss123!

Complete Archive Creation Playbook

# /home/thor/ansible/playbook_archive.yml
---
- name: Create and manage archives across application servers
  hosts: app_servers
  gather_facts: yes
  vars:
    archive_config:
      source_dir: /usr/src/data
      dest_dir: /opt/backup
      archive_name: data_backup.tar.gz
      archive_path: /opt/backup/data_backup.tar.gz
      format: gz
      permissions: '0644'

  tasks:
    # 1. Environment Setup
    - name: Create backup directory
      file:
        path: "{{ archive_config.dest_dir }}"
        state: directory
        mode: '0755'
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
      become: yes

    - name: Check disk space
      shell: "df -h {{ archive_config.dest_dir }} | awk 'NR==2 {print $5}' | sed 's/%//'"
      register: disk_usage
      become: yes
      changed_when: false

    - name: Fail if disk usage is high
      fail:
        msg: "Disk usage is at {{ disk_usage.stdout }}%, please free up space"
      when: disk_usage.stdout | int > 80

    # 2. Source Verification
    - name: Verify source directory exists
      stat:
        path: "{{ archive_config.source_dir }}"
      register: source_stat
      become: yes
      failed_when: not source_stat.stat.exists

    - name: Get source directory size
      command: "du -sh {{ archive_config.source_dir }}"
      register: source_size
      become: yes
      changed_when: false

    - name: Count files in source
      command: "find {{ archive_config.source_dir }} -type f | wc -l"
      register: file_count
      become: yes
      changed_when: false

    - name: Display source information
      debug:
        msg:
          - "📁 Source: {{ archive_config.source_dir }}"
          - "📊 Size: {{ source_size.stdout }}"
          - "📄 Files: {{ file_count.stdout }}"

    # 3. Archive Creation
    - name: Remove existing archive if present
      file:
        path: "{{ archive_config.archive_path }}"
        state: absent
      become: yes
      when: source_stat.stat.exists

    - name: Create tar.gz archive
      archive:
        path: "{{ archive_config.source_dir }}/"
        dest: "{{ archive_config.archive_path }}"
        format: "{{ archive_config.format }}"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "{{ archive_config.permissions }}"
        force_archive: yes
      become: yes
      when: source_stat.stat.exists
      register: archive_result

    # 4. Verification
    - name: Verify archive creation
      stat:
        path: "{{ archive_config.archive_path }}"
      register: archive_stat
      become: yes

    - name: Get archive size
      command: "du -sh {{ archive_config.archive_path }}"
      register: archive_size
      become: yes
      changed_when: false

    - name: Verify archive contents
      command: "tar -tzf {{ archive_config.archive_path }} | head -10"
      register: archive_contents
      become: yes
      changed_when: false

    # 5. Results
    - name: Display success message
      debug:
        msg:
          - "✅ Archive created successfully on {{ inventory_hostname }}"
          - "📦 File: {{ archive_config.archive_path }}"
          - "📊 Size: {{ archive_size.stdout }}"
          - "👤 Owner: {{ ansible_user }}"
          - "🔒 Permissions: {{ archive_config.permissions }}"
          - "📄 Contents preview:"
          - "{{ archive_contents.stdout_lines | to_nice_yaml }}"
      when: archive_stat.stat.exists

Complete Unarchive Playbook

# /home/thor/ansible/playbook_unarchive.yml
---
- name: Extract and distribute archives across application servers
  hosts: app_servers
  gather_facts: yes
  vars:
    unarchive_config:
      source_archive: /usr/src/data/datacenter.zip
      dest_dir: /opt/data
      permissions: '0655'

  tasks:
    # 1. Pre-flight Checks
    - name: Verify source archive exists on controller
      local_action:
        module: stat
        path: "{{ unarchive_config.source_archive }}"
      register: archive_stat
      run_once: yes
      failed_when: not archive_stat.stat.exists

    - name: Display archive information
      debug:
        msg:
          - "📦 Archive: {{ unarchive_config.source_archive }}"
          - "📊 Size: {{ (archive_stat.stat.size / 1024) | int }} KB"
          - "📅 Last modified: {{ archive_stat.stat.mtime }}"
      run_once: yes

    # 2. Dependencies
    - name: Ensure required packages are installed
      package:
        name:
          - unzip
          - tar
          - gzip
        state: present
      become: yes
      when: ansible_system == "Linux"

    - name: Create temporary directory
      file:
        path: /tmp/ansible_extract
        state: directory
        mode: '0755'
      become: yes

    # 3. Directory Setup
    - name: Create destination directory
      file:
        path: "{{ unarchive_config.dest_dir }}"
        state: directory
        mode: '0755'
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
      become: yes

    # 4. Archive Copy
    - name: Copy archive to remote host
      copy:
        src: "{{ unarchive_config.source_archive }}"
        dest: "/tmp/ansible_extract/{{ unarchive_config.source_archive | basename }}"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
      become: yes

    # 5. Extraction
    - name: Extract archive
      unarchive:
        src: "/tmp/ansible_extract/{{ unarchive_config.source_archive | basename }}"
        dest: "{{ unarchive_config.dest_dir }}"
        remote_src: yes
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "{{ unarchive_config.permissions }}"
        list_files: yes
      become: yes
      register: extract_result

    # 6. Cleanup
    - name: Remove temporary archive
      file:
        path: /tmp/ansible_extract
        state: absent
      become: yes

    # 7. Verification
    - name: Verify extraction
      shell: "find {{ unarchive_config.dest_dir }} -type f"
      register: extracted_files
      become: yes
      changed_when: false

    - name: Count extracted files
      shell: "find {{ unarchive_config.dest_dir }} -type f | wc -l"
      register: file_count
      become: yes
      changed_when: false

    - name: Check permissions
      shell: "find {{ unarchive_config.dest_dir }} -type f -perm {{ unarchive_config.permissions }} | wc -l"
      register: perm_count
      become: yes
      changed_when: false

    - name: Check ownership
      shell: "find {{ unarchive_config.dest_dir }} -type f -user {{ ansible_user }} -group {{ ansible_user }} | wc -l"
      register: owner_count
      become: yes
      changed_when: false

    # 8. Results
    - name: Display extraction summary
      debug:
        msg:
          - "✅ Extraction completed on {{ inventory_hostname }}"
          - "📁 Destination: {{ unarchive_config.dest_dir }}"
          - "📄 Total files: {{ file_count.stdout }}"
          - "👤 Correct owner: {{ owner_count.stdout }} files"
          - "🔒 Correct permissions: {{ perm_count.stdout }} files"
          - "📋 First 5 files:"
          - "{{ extracted_files.stdout_lines[:5] | to_nice_yaml }}"
      when: file_count.stdout | int > 0

6. Verification and Testing

🔍 Comprehensive Verification Commands

1. Archive Verification Commands

# Check if archive exists
ansible -i inventory app_servers -m stat -a "path=/opt/backup/data_backup.tar.gz"

# List archive contents
ansible -i inventory app_servers -m command -a "tar -tzf /opt/backup/data_backup.tar.gz"

# Check archive size
ansible -i inventory app_servers -m command -a "du -sh /opt/backup/data_backup.tar.gz"

# Verify checksum
ansible -i inventory app_servers -m command -a "md5sum /opt/backup/data_backup.tar.gz"

# Check permissions
ansible -i inventory app_servers -m command -a "stat -c '%a %n' /opt/backup/data_backup.tar.gz"

# Verify ownership
ansible -i inventory app_servers -m command -a "stat -c '%U:%G %n' /opt/backup/data_backup.tar.gz"

2. Unarchive Verification Commands

# List destination directory
ansible -i inventory app_servers -m command -a "ls -la /opt/data/"

# Recursive listing
ansible -i inventory app_servers -m command -a "find /opt/data -type f -ls"

# Count files
ansible -i inventory app_servers -m command -a "find /opt/data -type f | wc -l"

# Check permissions recursively
ansible -i inventory app_servers -m command -a "find /opt/data -type f -exec stat -c '%a %n' {} \;"

# Check ownership recursively
ansible -i inventory app_servers -m command -a "find /opt/data -type f -exec stat -c '%U:%G %n' {} \;"

# Verify file content
ansible -i inventory app_servers -m command -a "head -5 /opt/data/*.txt 2>/dev/null || echo 'No text files'"

3. Complete Verification Script

#!/bin/bash
# verify_ansible_task.sh

echo "========================================="
echo "Ansible Archive Management Verification"
echo "========================================="

INVENTORY="/home/thor/ansible/inventory"
SERVERS="app_servers"

echo -e "\n1️⃣ Checking Archive Existence..."
ansible -i $INVENTORY $SERVERS -m stat -a "path=/opt/backup/data_backup.tar.gz"

echo -e "\n2️⃣ Checking Archive Contents..."
ansible -i $INVENTORY $SERVERS -m shell -a "tar -tzf /opt/backup/data_backup.tar.gz | head -5"

echo -e "\n3️⃣ Checking Archive Permissions..."
ansible -i $INVENTORY $SERVERS -m shell -a "stat -c 'Permissions: %a | Owner: %U:%G | Size: %s | File: %n' /opt/backup/data_backup.tar.gz"

echo -e "\n4️⃣ Verifying Extraction..."
ansible -i $INVENTORY $SERVERS -m shell -a "ls -la /opt/data/"

echo -e "\n5️⃣ Counting Extracted Files..."
ansible -i $INVENTORY $SERVERS -m shell -a "find /opt/data -type f | wc -l"

echo -e "\n6️⃣ Checking Extraction Permissions..."
ansible -i $INVENTORY $SERVERS -m shell -a "find /opt/data -type f -exec stat -c 'Permissions: %a | Owner: %U:%G | File: %n' {} \;"

echo -e "\n✅ Verification Complete!"

4. Automated Test Playbook

---
- name: Validate archive management tasks
  hosts: app_servers
  gather_facts: yes
  tasks:
    - name: Test archive existence
      stat:
        path: /opt/backup/data_backup.tar.gz
      register: archive_check
      failed_when: not archive_check.stat.exists

    - name: Test archive size
      command: "du -sh /opt/backup/data_backup.tar.gz"
      register: archive_size
      changed_when: false

    - name: Test archive permissions
      command: "stat -c '%a' /opt/backup/data_backup.tar.gz"
      register: archive_perm
      changed_when: false
      failed_when: archive_perm.stdout != "644"

    - name: Test extraction directory
      stat:
        path: /opt/data
      register: extract_check
      failed_when: not extract_check.stat.exists

    - name: Count extracted files
      shell: "find /opt/data -type f | wc -l"
      register: file_count
      changed_when: false
      failed_when: file_count.stdout | int == 0

    - name: Validate all tests passed
      debug:
        msg:
          - "✅ All validation tests passed on {{ inventory_hostname }}"
          - "📦 Archive: /opt/backup/data_backup.tar.gz ({{ archive_size.stdout }})"
          - "🔒 Permissions: {{ archive_perm.stdout }}"
          - "📄 Extracted files: {{ file_count.stdout }}"

7. Troubleshooting Guide

🔧 Common Issues and Solutions

Issue 1: Source Archive Not Found

Symptom:

fatal: [stapp01]: FAILED! => {
    "msg": "Source file /usr/src/data/datacenter.zip does not exist"
}

Solution:

# Create the archive
sudo mkdir -p /usr/src/data
sudo touch /usr/src/data/file{1,2,3}.txt
sudo zip -r /usr/src/data/datacenter.zip /usr/src/data/*.txt

# Or create using ansible
ansible localhost -m file -a "path=/usr/src/data state=directory"
ansible localhost -m shell -a "touch /usr/src/data/file{1,2,3}.txt"
ansible localhost -m shell -a "zip -r /usr/src/data/datacenter.zip /usr/src/data/*.txt"

Issue 2: Permission Denied

Symptom:

fatal: [stapp01]: FAILED! => {
    "msg": "Permission denied"
}

Solution:

# Always use become: yes for system directories
- name: Create directory
  file:
    path: /opt/data
    state: directory
  become: yes

# Check sudo access
ansible -i inventory app_servers -m shell -a "sudo -l"

Issue 3: Archive Not in Correct Format

Symptom:

gzip: stdin: not in gzip format
tar: Child returned status 1

Solution:

# For archive module, use format: gz
- name: Create gzip archive
  archive:
    path: /usr/src/data/
    dest: /opt/backup/data.tar.gz
    format: gz  # Correct for .tar.gz
    force_archive: yes

# For unarchive, module auto-detects format
- name: Extract archive
  unarchive:
    src: /usr/src/data/datacenter.zip
    dest: /opt/data/
    remote_src: no

Issue 4: Unzip Not Installed

Symptom:

fatal: [stapp01]: FAILED! => {
    "msg": "unzip is required for unarchive module"
}

Solution:

# Install unzip before extraction
- name: Ensure unzip is installed
  package:
    name: unzip
    state: present
  become: yes

# For RedHat/CentOS
- name: Install unzip
  yum:
    name: unzip
    state: present
  become: yes

# For Ubuntu/Debian
- name: Install unzip
  apt:
    name: unzip
    state: present
  become: yes

Issue 5: Wrong Ownership After Extraction

Symptom:

-rw-r--r-- 1 root root file.txt  # Should be tony:tony

Solution:

# Set ownership during extraction
- name: Extract with correct ownership
  unarchive:
    src: /usr/src/data/datacenter.zip
    dest: /opt/data/
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: '0655'
  become: yes

# Or fix after extraction
- name: Fix ownership
  file:
    path: /opt/data
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    recurse: yes
  become: yes

Issue 6: Host Key Verification Failed

Symptom:

Host key verification failed

Solution:

# Add to inventory
ansible_ssh_common_args='-o StrictHostKeyChecking=no'

# Or add to ansible.cfg
[defaults]
host_key_checking = False

# Or remove from known_hosts
ssh-keygen -R stapp01

Issue 7: Module Not Found

Symptom:

ERROR! no action detected in task

Solution:

# Check module exists
ansible-doc -l | grep archive
ansible-doc -l | grep unarchive

# Update Ansible
sudo yum update -y ansible

# For older versions, use shell commands
- name: Create archive using shell
  shell: tar -czf /opt/backup/data.tar.gz -C /usr/src data/

8. Security Best Practices

🔐 Protecting Your Automation

1. SSH Key Management

# Generate strong SSH key
ssh-keygen -t ed25519 -C "thor-ansible-$(date +%Y%m%d)"

# Use ssh-agent to manage keys
eval $(ssh-agent)
ssh-add ~/.ssh/id_ed25519

# Copy keys to servers
ssh-copy-id tony@stapp01
ssh-copy-id steve@stapp02
ssh-copy-id banner@stapp03

2. Ansible Vault for Secrets

# Create encrypted file
ansible-vault create group_vars/all/vault.yml

# Content of vault.yml
---
vault_ssh_pass: "Ir0nM@n"
vault_sudo_pass: "Ir0nM@n"

# Use in inventory
[app_servers]
stapp01 ansible_host=stapp01 ansible_user=tony ansible_ssh_pass={{ vault_ssh_pass }}

# Run playbook with vault
ansible-playbook -i inventory playbook.yml --ask-vault-pass

3. Secure File Permissions

# Set secure permissions on sensitive files
- name: Secure inventory file
  file:
    path: /home/thor/ansible/inventory
    mode: '0600'
    owner: thor
    group: thor

- name: Secure playbook files
  file:
    path: /home/thor/ansible/playbook.yml
    mode: '0644'
    owner: thor
    group: thor

4. Ansible Configuration Security

# /etc/ansible/ansible.cfg
[defaults]
host_key_checking = False
timeout = 30
private_key_file = /home/thor/.ssh/id_ed25519
remote_user = thor
ask_pass = False
vault_password_file = /etc/ansible/.vault_pass

[privilege_escalation]
become = True
become_method = sudo
become_user = root
become_ask_pass = False

5. Auditing and Logging

---
- name: Enable logging
  hosts: localhost
  tasks:
    - name: Configure ansible logging
      lineinfile:
        path: /etc/ansible/ansible.cfg
        regexp: '^log_path'
        line: 'log_path = /var/log/ansible/ansible.log'
      become: yes

    - name: Create log directory
      file:
        path: /var/log/ansible
        state: directory
        mode: '0755'
      become: yes

    - name: Set log rotation
      copy:
        dest: /etc/logrotate.d/ansible
        content: |
          /var/log/ansible/*.log {
              daily
              rotate 30
              compress
              delaycompress
              missingok
              notifempty
              create 0640 thor thor
          }
      become: yes

9. Performance Optimization

⚡ Speed Up Your Automation

1. Use Gather Facts Wisely

---
# Skip gather facts for faster execution
- name: Fast playbook
  hosts: app_servers
  gather_facts: no  # <-- Speeds up execution

# Use gather facts only when needed
- name: Playbook with conditional facts
  hosts: app_servers
  gather_facts: yes
  when: ansible_system == "Linux"

2. Use `creates` to Avoid Re-running Commands

- name: Extract archive (only if not extracted)
  unarchive:
    src: /usr/src/data/datacenter.zip
    dest: /opt/data/
  args:
    creates: /opt/data/flag_file  # Skip if flag exists

3. Use Async for Long-running Tasks

- name: Extract large archive
  unarchive:
    src: /usr/src/data/large_archive.zip
    dest: /opt/data/
  async: 3600
  poll: 0
  become: yes

- name: Check async status
  async_status:
    jid: "{{ ansible_job_id }}"
  register: job_result
  until: job_result.finished
  retries: 60
  delay: 10

4. Use Strategy Plugins

---
- name: Efficient playbook execution
  hosts: app_servers
  strategy: free  # Run tasks as fast as possible
  gather_facts: no
  tasks:
    - name: Extract archive
      unarchive:
        src: /usr/src/data/datacenter.zip
        dest: /opt/data/
      become: yes

5. Parallel Execution

# Use forks to run in parallel
ansible-playbook -i inventory playbook.yml --forks 10

# Set in ansible.cfg
[defaults]
forks = 20

10. Conclusion

🎯 Key Takeaways

What We've Learned

Module	Purpose	Key Parameters	Best Use Case
Archive	Create compressed archives	`path`, `dest`, `format`, `mode`	Backups, data packaging
Unarchive	Extract compressed archives	`src`, `dest`, `owner`, `group`	Deployments, data distribution

Best Practices Summary

Inventory Management
- Use group/host variables
- Separate credentials from inventory
- Use Ansible Vault for secrets
Module Usage
- Use archive for creating backups
- Use unarchive for deployments
- Always set ownership and permissions
- Use become: yes for system directories
Playbook Design
- Make playbooks idempotent
- Include verification tasks
- Handle errors gracefully
- Use variables for reusability
Security
- Use SSH keys instead of passwords
- Encrypt sensitive data
- Set proper file permissions
- Enable logging for auditing
Performance
- Skip gather facts when possible
- Use creates for idempotency
- Increase forks for parallel execution
- Use async for long tasks

Complete Command Reference

# Archive Creation
ansible -i inventory app_servers -m archive -a "path=/usr/src/data/ dest=/opt/backup/data.tar.gz format=gz"

# Archive Extraction
ansible -i inventory app_servers -m unarchive -a "src=/usr/src/data/datacenter.zip dest=/opt/data/"

# Verification
ansible -i inventory app_servers -m stat -a "path=/opt/backup/data.tar.gz"
ansible -i inventory app_servers -m shell -a "tar -tzf /opt/backup/data.tar.gz"
ansible -i inventory app_servers -m shell -a "ls -la /opt/data/"

# Playbook Execution
ansible-playbook -i inventory playbook.yml
ansible-playbook -i inventory playbook.yml --check  # Dry run
ansible-playbook -i inventory playbook.yml --verbose

🚀 Next Steps

Expand Your Skills
- Learn about Ansible Roles
- Explore Ansible Tower/AWX
- Implement CI/CD with Ansible
Additional Modules to Explore
- copy - Copy files from controller to hosts
- synchronize - Rsync-like file synchronization
- template - Jinja2 templating
- file - File and directory management
Real-World Applications
- Application deployment pipelines
- Configuration management
- Infrastructure as Code
- Disaster recovery automation

📚 Resources

Ansible Documentation: https://docs.ansible.com/
Module Index: https://docs.ansible.com/ansible/latest/collections/index.html
Best Practices: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_best_practices.html
Ansible Galaxy: https://galaxy.ansible.com/

🎉 Final Thoughts

Mastering Ansible's archive and unarchive modules is essential for any DevOps engineer. These modules provide the foundation for:

Efficient Data Management: Compress and extract files across multiple servers
Automated Deployments: Distribute application packages consistently
Reliable Backups: Create and store backups automatically
Configuration Distribution: Deploy configuration files at scale

The skills you've learned in this guide will serve you well in your DevOps journey. Remember to always test your playbooks in a safe environment before deploying to production, and continuously refine your automation practices.

Ansible Archive Module

Janak Shrestha — Sat, 29 Aug 2026 05:53:14 +0000

The Nautilus DevOps team has some data on each app server in Stratos DC that they want to copy to a different location. However, they want to create an archive of the data first, then they want to copy the same to a different location on the respective app server. Additionally, there are some specific requirements for each server. Perform the task using Ansible playbook as per requirements mentioned below:

Create a playbook named playbook.yml under /home/thor/ansible directory on jump host, an inventory file is already placed under /home/thor/ansible/ directory on Jump Server itself.

Create an archive beta.tar.gz (make sure archive format is tar.gz) of /usr/src/itadmin/ directory ( present on each app server ) and copy it to /opt/itadmin/ directory on all app servers. The user and group owner of archive beta.tar.gz should be tony for App Server 1, steve for App Server 2 and banner for App Server 3.

Note: Validation will try to run playbook using command ansible-playbook -i inventory playbook.yml so please make sure playbook works this way, without passing any extra arguments.

Introduction

In the fast-paced world of DevOps, automation is the key to maintaining efficiency, consistency, and reliability across infrastructure. The Nautilus DevOps team recently faced a challenge: they needed to archive data from multiple application servers and move it to different locations with specific ownership requirements. Instead of performing this task manually on each server, they turned to Ansible—and the results were outstanding.

This comprehensive guide walks through the entire process of creating an Ansible playbook to archive a directory and copy it to a different location with specific ownership requirements across multiple servers.

Understanding the Requirements
Prerequisites and Setup
Inventory Configuration
Playbook Design and Implementation
Execution and Verification
Troubleshooting Common Issues
Best Practices and Key Takeaways
Conclusion

Understanding the Requirements

The DevOps team had specific requirements for all application servers in the Stratos DC:

Component	Details
Source Directory	`/usr/src/finance/` (exists on each app server)
Destination Directory	`/opt/finance/` (create if not exists)
Archive Name	`official.tar.gz`
Archive Format	tar.gz (compressed archive)
Server	Owner & Group
stapp01	tony
stapp02	steve
stapp03	banner

The Task Must Be Performed Using:

ansible-playbook -i inventory playbook.yml

No additional arguments should be required.

Prerequisites and Setup

Before diving into the implementation, ensure the following prerequisites are met:

1. Ansible Installation

# Verify Ansible is installed
ansible --version

# If not installed, install via yum
sudo yum install -y ansible

2. SSH Connectivity

# Test SSH connectivity to each server
ssh -o StrictHostKeyChecking=no tony@stapp01 "echo 'Connected'"
ssh -o StrictHostKeyChecking=no steve@stapp02 "echo 'Connected'"
ssh -o StrictHostKeyChecking=no banner@stapp03 "echo 'Connected'"

3. Directory Structure

# Create the working directory
mkdir -p /home/thor/ansible
cd /home/thor/ansible

Inventory Configuration

The inventory file serves as the foundation for Ansible connectivity. Here's the complete inventory configuration:

cat > /home/thor/ansible/inventory << 'EOF'
[app_servers]
stapp01 ansible_user=tony ansible_ssh_pass=Ir0nM@n ansible_ssh_common_args='-o StrictHostKeyChecking=no'
stapp02 ansible_user=steve ansible_ssh_pass=Am3ric@ ansible_ssh_common_args='-o StrictHostKeyChecking=no'
stapp03 ansible_user=banner ansible_ssh_pass=BigGr33n ansible_ssh_common_args='-o StrictHostKeyChecking=no'
EOF

Inventory Breakdown:

Group: [app_servers] - All application servers
Host: Unique identifier for each server
ansible_user: SSH username for authentication
ansible_ssh_pass: SSH password for authentication
ansible_ssh_common_args: Additional SSH options
StrictHostKeyChecking=no: Disables host key verification

Verify Inventory

# Test inventory connectivity
ansible -i inventory app_servers -m ping

Playbook Design and Implementation

The playbook is designed with idempotency, error handling, and flexibility in mind.

Complete Playbook

cat > /home/thor/ansible/playbook.yml << 'EOF'
---
- name: Archive and copy finance directory across app servers
  hosts: app_servers
  gather_facts: no
  vars:
    source_dir: /usr/src/finance
    dest_dir: /opt/finance
    archive_path: /opt/finance/official.tar.gz

  tasks:
    # Task 1: Create destination directory
    - name: Create destination directory
      file:
        path: "{{ dest_dir }}"
        state: directory
        mode: '0755'
      become: yes

    # Task 2: Verify source directory exists
    - name: Verify source directory exists
      stat:
        path: "{{ source_dir }}"
      register: source_stat
      become: yes
      failed_when: not source_stat.stat.exists

    # Task 3: Remove existing archive if present
    - name: Remove existing archive if present
      file:
        path: "{{ archive_path }}"
        state: absent
      become: yes
      when: source_stat.stat.exists

    # Task 4: Create tar.gz archive
    - name: Create tar.gz archive of finance directory
      archive:
        path: "{{ source_dir }}/"
        dest: "{{ archive_path }}"
        format: gz
        force_archive: yes
      become: yes
      when: source_stat.stat.exists

    # Task 5: Set ownership of the archive
    - name: Set ownership of official.tar.gz
      file:
        path: "{{ archive_path }}"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
      become: yes

    # Task 6: Verify archive exists
    - name: Verify archive exists
      stat:
        path: "{{ archive_path }}"
      register: archive_stat
      become: yes

    # Task 7: Display completion message
    - name: Display completion message
      debug:
        msg: "Successfully created {{ archive_path }} on {{ inventory_hostname }} with owner {{ ansible_user }}"
      when: archive_stat.stat.exists
EOF

Alternative Playbook Using Shell Module

If the archive module is unavailable or problematic:

cat > /home/thor/ansible/playbook.yml << 'EOF'
---
- name: Archive and copy finance directory across app servers
  hosts: app_servers
  gather_facts: no
  vars:
    source_dir: /usr/src/finance
    dest_dir: /opt/finance
    archive_path: /opt/finance/official.tar.gz

  tasks:
    - name: Create destination directory
      file:
        path: "{{ dest_dir }}"
        state: directory
        mode: '0755'
      become: yes

    - name: Verify source directory exists
      stat:
        path: "{{ source_dir }}"
      register: source_stat
      become: yes
      failed_when: not source_stat.stat.exists

    - name: Remove existing archive if present
      file:
        path: "{{ archive_path }}"
        state: absent
      become: yes
      when: source_stat.stat.exists

    - name: Create tar.gz archive using shell
      shell: |
        tar -czf "{{ archive_path }}" -C "{{ source_dir | dirname }}" "{{ source_dir | basename }}"
      become: yes
      when: source_stat.stat.exists
      args:
        creates: "{{ archive_path }}"

    - name: Set ownership of official.tar.gz
      file:
        path: "{{ archive_path }}"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
      become: yes

    - name: Verify archive exists
      stat:
        path: "{{ archive_path }}"
      register: archive_stat
      become: yes

    - name: Display completion message
      debug:
        msg: "Successfully created {{ archive_path }} on {{ inventory_hostname }} with owner {{ ansible_user }}"
      when: archive_stat.stat.exists
EOF

Playbook Features Explained

1. Variables

vars:
  source_dir: /usr/src/finance
  dest_dir: /opt/finance
  archive_path: /opt/finance/official.tar.gz

Variables make the playbook reusable and easier to maintain. Changing the source or destination paths requires only one modification.

2. Directory Creation

- name: Create destination directory
  file:
    path: "{{ dest_dir }}"
    state: directory
    mode: '0755'
  become: yes

Creates the destination directory with proper permissions. The become: yes ensures administrative privileges.

3. Source Verification

- name: Verify source directory exists
  stat:
    path: "{{ source_dir }}"
  register: source_stat
  become: yes
  failed_when: not source_stat.stat.exists

Ensures the source directory exists before attempting to archive. Prevents the playbook from failing unexpectedly.

4. Archive Creation

- name: Create tar.gz archive
  archive:
    path: "{{ source_dir }}/"
    dest: "{{ archive_path }}"
    format: gz
    force_archive: yes
  become: yes

Creates the tar.gz archive using the archive module with format: gz. The force_archive: yes ensures the archive is recreated even if it already exists.

5. Dynamic Ownership

- name: Set ownership of official.tar.gz
  file:
    path: "{{ archive_path }}"
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: '0644'
  become: yes

Uses {{ ansible_user }} to dynamically set the correct owner:

stapp01 → tony
stapp02 → steve
stapp03 → banner

6. Verification

- name: Verify archive exists
  stat:
    path: "{{ archive_path }}"
  register: archive_stat
  become: yes

Confirms the archive was successfully created before displaying the completion message.

Execution and Verification

Running the Playbook

cd /home/thor/ansible
ansible-playbook -i inventory playbook.yml

Expected Output

PLAY [Archive and copy finance directory across app servers] ********************

TASK [Create destination directory] *********************************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

TASK [Verify source directory exists] ******************************************
ok: [stapp01]
ok: [stapp02]
ok: [stapp03]

TASK [Remove existing archive if present] **************************************
ok: [stapp01]
ok: [stapp02]
ok: [stapp03]

TASK [Create tar.gz archive of finance directory] ******************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

TASK [Set ownership of official.tar.gz] ****************************************
changed: [stapp01]
changed: [stapp02]
changed: [stapp03]

TASK [Verify archive exists] ***************************************************
ok: [stapp01]
ok: [stapp02]
ok: [stapp03]

TASK [Display completion message] **********************************************
ok: [stapp01] => {
    "msg": "Successfully created /opt/finance/official.tar.gz on stapp01 with owner tony"
}
ok: [stapp02] => {
    "msg": "Successfully created /opt/finance/official.tar.gz on stapp02 with owner steve"
}
ok: [stapp03] => {
    "msg": "Successfully created /opt/finance/official.tar.gz on stapp03 with owner banner"
}

PLAY RECAP *********************************************************************
stapp01 : ok=7 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
stapp02 : ok=7 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
stapp03 : ok=7 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

Verification Commands

# 1. Check if archive exists
ansible -i inventory app_servers -m shell -a "ls -la /opt/finance/official.tar.gz"

# Expected Output:
# stapp01: -rw-r--r-- 1 tony tony 215 /opt/finance/official.tar.gz
# stapp02: -rw-r--r-- 1 steve steve 226 /opt/finance/official.tar.gz
# stapp03: -rw-r--r-- 1 banner banner 210 /opt/finance/official.tar.gz

# 2. Check archive content (should work without errors)
ansible -i inventory app_servers -m shell -a "tar -tzf /opt/finance/official.tar.gz"

# Expected Output:
# stapp01: blog.txt
# stapp02: story.txt
# stapp03: media.txt

# 3. Check ownership
ansible -i inventory app_servers -m shell -a "stat -c '%U:%G %n' /opt/finance/official.tar.gz"

# Expected Output:
# stapp01: tony:tony /opt/finance/official.tar.gz
# stapp02: steve:steve /opt/finance/official.tar.gz
# stapp03: banner:banner /opt/finance/official.tar.gz

# 4. Check archive size
ansible -i inventory app_servers -m shell -a "du -sh /opt/finance/official.tar.gz"

# Expected Output:
# stapp01: 4.0K /opt/finance/official.tar.gz
# stapp02: 4.0K /opt/finance/official.tar.gz
# stapp03: 4.0K /opt/finance/official.tar.gz

# 5. Verify ownership on each server individually
ansible -i inventory stapp01 -m shell -a "stat -c '%U:%G' /opt/finance/official.tar.gz"  # Should show tony:tony
ansible -i inventory stapp02 -m shell -a "stat -c '%U:%G' /opt/finance/official.tar.gz"  # Should show steve:steve
ansible -i inventory stapp03 -m shell -a "stat -c '%U:%G' /opt/finance/official.tar.gz"  # Should show banner:banner

Video Demonstration

For a complete visual guide, watch this demonstration:

Troubleshooting Common Issues

Issue 1: Source Directory Doesn't Exist

Symptom:

fatal: [stapp01]: FAILED! => {
    "msg": "Source directory does not exist"
}

Solution:

# Create the directory and test data
ansible -i inventory app_servers -m file -a "path=/usr/src/finance state=directory mode=0755"
ansible -i inventory app_servers -m copy -a "content='Financial data\n' dest=/usr/src/finance/records.txt"
ansible -i inventory app_servers -m copy -a "content='Blog content\n' dest=/usr/src/finance/blog.txt"

Issue 2: Archive Not in Gzip Format

Symptom:

gzip: stdin: not in gzip format
tar: Child returned status 1

Solution:

Use the shell module version with tar -czf instead of the archive module
Ensure format: gz is specified when using the archive module

# Correct archive module usage
archive:
  path: "/usr/src/finance/"
  dest: "/opt/finance/official.tar.gz"
  format: gz
  force_archive: yes

# Or use shell module
shell: tar -czf /opt/finance/official.tar.gz -C /usr/src finance

Issue 3: Permission Denied

Symptom:

fatal: [stapp01]: FAILED! => {
    "msg": "Permission denied"
}

Solution:

# Ensure 'become: yes' is used for all administrative tasks
# Check sudo privileges for the user
ansible -i inventory app_servers -m shell -a "sudo -l"

# If password is required for sudo, add to inventory
# ansible_become_pass=Ir0nM@n

Issue 4: Wrong Ownership

Symptom:

-rw-r--r-- 1 root root /opt/finance/official.tar.gz

Solution:

# Verify inventory user mapping
cat /home/thor/ansible/inventory

# Ensure ansible_user variable is correct for each server
# stapp01 -> tony
# stapp02 -> steve
# stapp03 -> banner

# Manually fix ownership if needed
ansible -i inventory stapp01 -m file -a "path=/opt/finance/official.tar.gz owner=tony group=tony mode=0644"

Issue 5: Connection Timeout

Symptom:

fatal: [stapp01]: UNREACHABLE! => {
    "msg": "Failed to connect to the host via ssh"
}

Solution:

# Test network connectivity
ping -c 3 stapp01

# Check SSH port
nc -zv stapp01 22

# Verify SSH credentials
ssh -o StrictHostKeyChecking=no tony@stapp01

# Increase timeout in inventory
ansible_ssh_timeout=60

Issue 6: Host Key Verification Failed

Symptom:

Host key verification failed

Solution:

# Add to inventory
ansible_ssh_common_args='-o StrictHostKeyChecking=no'

# Or remove from known_hosts
ssh-keygen -R stapp01

Issue 7: Archive Module Not Available

Symptom:

ERROR! no action detected in task

Solution:

Use the shell module alternative
Update Ansible to a newer version

sudo yum update -y ansible

Best Practices and Key Takeaways

1. Dynamic Ownership

Using {{ ansible_user }} from the inventory makes the playbook flexible and reusable across different servers with different users. This eliminates hardcoding and simplifies maintenance.

Benefits:

No need to create separate playbooks for each server
Easy to add new servers with different users
Single source of truth for user mapping

2. Idempotency

The playbook can be run multiple times without causing errors or creating duplicate archives.

Implementation:

creates argument in shell commands
force_archive option in archive module
state: absent before creating new archive

3. Error Handling

Using failed_when and conditional execution (when) prevents the playbook from failing unnecessarily.

Best Practices:

Always check source existence before operations
Use register to capture results
Provide meaningful error messages
Use ignore_errors for non-critical tasks

4. Verification

Built-in verification tasks provide confidence that the operation was successful on all servers.

Verification Steps:

Check if archive exists
Verify correct ownership
Confirm archive content
Validate file permissions

5. Use of Become

Using become: yes for administrative tasks ensures the playbook has the necessary permissions.

When to Use:

Creating directories in /opt/
Writing to system directories
Changing file ownership
Installing packages

6. Modular Design

Using variables and reusable tasks makes the playbook modular and maintainable.

Benefits:

Easy to update paths
Simple to extend functionality
Clear separation of concerns

7. Documentation

Inline comments explain the purpose of each task, making the playbook self-documenting.

Documentation Tips:

Add task descriptions
Explain complex logic
Include variable definitions
Provide usage examples

Conclusion

The Ansible playbook successfully automates the process of:

✅ Directory Management: Creating destination directories with proper permissions
✅ Archive Creation: Compressing source directories into tar.gz format
✅ File Transfer: Copying archives to target locations
✅ Ownership Management: Setting correct ownership based on server requirements
✅ Verification: Confirming successful execution on all servers
✅ Idempotency: Safe to run multiple times

Results Summary

Server	Source File	Archive Created	Owner	Status
stapp01	blog.txt	official.tar.gz	tony:tony	✅
stapp02	story.txt	official.tar.gz	steve:steve	✅
stapp03	media.txt	official.tar.gz	banner:banner	✅

Key Achievements

Time Savings: Automated what would be a manual 15-minute task per server
Consistency: Same process applied across all servers
Reliability: Idempotent execution ensures no duplicate archives
Maintainability: Easy to update for future requirements
Scalability: Can be extended to additional servers
Extend the Playbook: Add additional directories or file types
Implement Scheduling: Use Ansible Tower or cron for regular archiving
Add Monitoring: Implement logging and notification for archive operations
Define Retention Policies: Set up automated cleanup of old archives
Implement Backup Integration: Connect with backup systems for disaster recovery
Create Documentation: Document the playbook for team members

Configuring Cron Job on Nautilus Storage Server

Janak Shrestha — Sat, 29 Aug 2026 05:36:13 +0000

Configuring Cron Job on Nautilus Storage Server

Objective

This document outlines the procedure for installing and configuring a cron job on the Nautilus Storage Server (ststor01) in the Stratos Datacenter. The system administration team requires the following configuration:

Install the cronie package and start the crond service
Add a cron job to the root user's crontab that executes /usr/bin/touch test_passed daily at 21:30

Environment Details

Server: ststor01 (Nautilus Storage Server)
Access User: natasha
Access Password: Bl@kW
Sudo Privileges: Required

Implementation Methods

Method 1: One-Line Command Execution

Execute the following command from the jump host to perform all required actions:

echo 'Bl@kW' | ssh natasha@ststor01 "sudo -S bash -c 'yum install -y cronie && systemctl start crond && systemctl enable crond && (crontab -l 2>/dev/null; echo \"30 21 * * * /usr/bin/touch test_passed\") | crontab - && crontab -l'"

This command performs the following actions:

Installs the cronie package
Starts the crond service
Enables crond to start on boot
Adds the cron job to root's crontab
Displays the current crontab for verification

Method 2: Heredoc Method

For a comprehensive output with detailed verification, use the heredoc approach:

ssh natasha@ststor01 << 'EOF'
echo 'Bl@kW' | sudo -S bash -c '
echo "Installing cronie package"
yum install -y cronie

echo "Starting crond service"
systemctl start crond
systemctl enable crond

echo "Service Status"
systemctl status crond | grep -E "Active|Loaded"

echo "Adding cron job to root crontab"
(crontab -l 2>/dev/null; echo "30 21 * * * /usr/bin/touch test_passed") | crontab -

echo "Current Crontab"
crontab -l

echo "Verification"
crontab -l | grep -q "30 21 \* \* \* /usr/bin/touch test_passed" && echo "Cron job added successfully" || echo "Cron job not found"
'
EOF

Method 3: Interactive Session

For manual execution, connect to the server and perform the following commands:

# Connect to storage server
ssh natasha@ststor01
# Enter password: Bl@kW

# Switch to root
sudo su -
# Enter password: Bl@kW

# Install cronie
yum install -y cronie

# Start and enable crond service
systemctl start crond
systemctl enable crond

# Verify service status
systemctl status crond

# Add cron job to root's crontab
(crontab -l 2>/dev/null; echo "30 21 * * * /usr/bin/touch test_passed") | crontab -

# Verify the cron job
crontab -l

# Exit
exit
exit

Command Breakdown

Installation and Service Commands

yum install -y cronie: Installs the cronie package non-interactively
systemctl start crond: Starts the cron daemon service
systemctl enable crond: Configures crond to start automatically at boot

Cron Job Addition

The command structure for adding the cron job is:

(crontab -l 2>/dev/null; echo "30 21 * * * /usr/bin/touch test_passed") | crontab -

This command:

crontab -l 2>/dev/null: Lists existing crontab entries, suppressing errors if none exist
echo "30 21 * * * /usr/bin/touch test_passed": Defines the new cron job
| crontab -: Pipes the combined output to replace the crontab

Cron Syntax Explained

The cron expression 30 21 * * * consists of:

Position	Value	Meaning
Minute	30	At 30 minutes past the hour
Hour	21	At 21:00 (9:30 PM)
Day of Month	*	Every day of the month
Month	*	Every month
Day of Week	*	Every day of the week

The command /usr/bin/touch test_passed updates the timestamp of the file test_passed in the current working directory (root's home directory by default).

Verification Procedures

After configuration, verify the setup using these commands:

# Verify cronie installation
rpm -qa | grep cronie

# Verify crond service status
systemctl status crond

# Verify crond is enabled on boot
systemctl is-enabled crond

# View root's crontab
crontab -l

# Verify the specific cron job exists
crontab -l | grep "30 21"

# Check cron logs for activity
tail -f /var/log/cron

# Check system logs for cron activity
journalctl -u crond | tail -20

Expected Output

Upon successful execution, the system should display:

Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Package cronie-1.5.2-4.el8.x86_64 already installed and latest version
Nothing to do

Created symlink from /etc/systemd/system/multi-user.target.wants/crond.service to /usr/lib/systemd/system/crond.service.

● crond.service - Command Scheduler
   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2026-07-19 10:00:00 UTC; 1min ago
 Main PID: 1234 (crond)
    Tasks: 1 (limit: 512)
   Memory: 1.2M
   CGroup: /system.slice/crond.service
           └─1234 /usr/sbin/crond -n

30 21 * * * /usr/bin/touch test_passed

Alternative Approaches

Method 1: Direct Crontab Editing

# Open root's crontab in editor
crontab -e

# Add this line:
30 21 * * * /usr/bin/touch test_passed

# Save and exit

Method 2: Using /etc/crontab

# Add to system-wide crontab
echo "30 21 * * * root /usr/bin/touch test_passed" >> /etc/crontab

Method 3: Using Cron Directory

# Create a file in cron.d directory
echo "30 21 * * * root /usr/bin/touch test_passed" > /etc/cron.d/test_passed

Method 4: Preserving Existing Crontab

# Backup existing crontab, add new job, restore
crontab -l > /tmp/crontab_backup 2>/dev/null
echo "30 21 * * * /usr/bin/touch test_passed" >> /tmp/crontab_backup
crontab /tmp/crontab_backup
rm /tmp/crontab_backup

Troubleshooting

Issue 1: Package Not Found

# Search for available cron packages
yum search cronie

# Try alternative package names
yum install -y vixie-cron crontabs

Issue 2: Service Start Failure

# Check service logs
journalctl -u crond -n 50

# Reload systemd
systemctl daemon-reload

# Check service unit file
systemctl cat crond

Issue 3: Crontab Command Not Found

# Install crontabs package
yum install -y crontabs

Issue 4: Cron Job Not Executing

# Verify crond is running
systemctl status crond

# Check logs for errors
tail -f /var/log/cron

# Verify command path
which touch

# Use absolute path in cron command

Issue 5: Permission Denied

# Use sudo for all operations
sudo crontab -e

# Or switch to root
sudo su -

Issue 6: File Not Created

# Use absolute path in command
echo "30 21 * * * /usr/bin/touch /root/test_passed" | crontab -

# Verify working directory
crontab -l | grep touch

Cron Locations Reference

Location	Purpose
`/etc/crontab`	System-wide crontab file
`/etc/cron.d/`	Directory for system crontab files
`/etc/cron.hourly/`	Scripts executed every hour
`/etc/cron.daily/`	Scripts executed daily
`/etc/cron.weekly/`	Scripts executed weekly
`/etc/cron.monthly/`	Scripts executed monthly
`/var/spool/cron/`	User-specific crontab files

Automated Script

For repeatable deployments, save this as setup_cron.sh:

#!/bin/bash

echo "Configuring Cron Job on Storage Server"

ssh natasha@ststor01 << 'EOF'
echo 'Bl@kW' | sudo -S bash -c '
echo "Installing cronie"
yum install -y cronie

echo "Starting and enabling crond"
systemctl start crond
systemctl enable crond

echo "Service Status"
systemctl status crond | grep -E "Active|Loaded"

echo "Adding cron job"
(crontab -l 2>/dev/null; echo "30 21 * * * /usr/bin/touch test_passed") | crontab -

echo "Current Crontab"
crontab -l

echo "Verification"
crontab -l | grep -q "30 21 \* \* \* /usr/bin/touch test_passed" && echo "Cron job added successfully" || echo "Cron job not found"
'
EOF

Make the script executable and run:

chmod +x setup_cron.sh
./setup_cron.sh

Summary

The cron job has been successfully configured on the Nautilus Storage Server (ststor01) with the following specifications:

Package: cronie installed
Service: crond running and enabled on boot
Cron Job: 30 21 * * * /usr/bin/touch test_passed
Schedule: Every day at 21:30 (9:30 PM)
Command: Updates timestamp on test_passed file
User: Root user's crontab
Status: Verified and active

The configuration has been completed successfully, and the cron job will execute daily at the specified time. The system logs can be monitored to confirm the execution of the cron job.

Creating User Mohammed on App Server 3 in Stratos Datacenter

Janak Shrestha — Sat, 29 Aug 2026 05:34:25 +0000

Creating User Mohammed on App Server 3 in Stratos Datacenter

Objective

This document outlines the procedure for creating a new user account on App Server 3 (stapp03) in the Stratos Datacenter. The system administration team has specified the following requirements:

Username: mohammed
UID: 1403
Home Directory: /opt/mohammed
Primary Group: nautilus_admin_users

Environment Details

Server: stapp03 (App Server 3)
Access User: banner
Access Password: BigGr33n
Sudo Privileges: Required

Implementation Methods

Method 1: One-Line Command Execution

Execute the following command from the jump host to create the user and group with a single command:

echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'groupadd nautilus_admin_users 2>/dev/null; useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users mohammed 2>/dev/null; id mohammed; groups mohammed; ls -ld /opt/mohammed'"

This command performs the following actions:

Creates the group nautilus_admin_users if it does not already exist
Creates the user mohammed with UID 1403, home directory /opt/mohammed, and sets nautilus_admin_users as the primary group
Displays verification information for the newly created user

Method 2: Heredoc Method

For a more comprehensive output with detailed verification, use the heredoc approach:

ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Creating group nautilus_admin_users"
groupadd nautilus_admin_users 2>/dev/null || echo "Group already exists"

echo "Creating user mohammed"
useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users mohammed 2>/dev/null || echo "User already exists"

echo "Verification Results:"
echo "User Details:"
id mohammed

echo "Home Directory:"
ls -ld /opt/mohammed

echo "Group Membership:"
groups mohammed

echo "User Entry in /etc/passwd:"
grep mohammed /etc/passwd

echo "Group Entry in /etc/group:"
grep nautilus_admin_users /etc/group
'
EOF

Method 3: Interactive Session

For manual execution, connect to the server and perform the following commands:

# Connect to App Server 3
ssh banner@stapp03
# Enter password: BigGr33n

# Switch to root
sudo su -
# Enter password: BigGr33n

# Create the group
groupadd nautilus_admin_users

# Create the user with specified parameters
useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users mohammed

# Verify the creation
id mohammed
ls -ld /opt/mohammed
groups mohammed
grep mohammed /etc/passwd
grep nautilus_admin_users /etc/group

# Exit
exit
exit

Command Breakdown

The useradd command uses the following parameters:

-u 1403: Sets the user ID to 1403
-d /opt/mohammed: Specifies the home directory location
-m: Creates the home directory if it does not exist
-g nautilus_admin_users: Sets the primary group
mohammed: The username

Verification Procedures

After creating the user, verify the configuration using these commands:

# Verify user exists and UID is correct
id mohammed

# Verify home directory exists and ownership
ls -ld /opt/mohammed

# Verify group membership
groups mohammed

# Verify user entry in system files
grep mohammed /etc/passwd

# Verify group exists
getent group nautilus_admin_users

Expected Output

Upon successful execution, the system should display:

uid=1403(mohammed) gid=1404(nautilus_admin_users) groups=1404(nautilus_admin_users)
drwx------ 2 mohammed nautilus_admin_users 4096 Jul 19 10:00 /opt/mohammed
mohammed : nautilus_admin_users
mohammed:x:1403:1404::/opt/mohammed:/bin/bash
nautilus_admin_users:x:1404:mohammed

Alternative Approaches

Manual Home Directory Creation

If the home directory needs to be created separately:

mkdir -p /opt/mohammed
useradd -u 1403 -d /opt/mohammed -g nautilus_admin_users mohammed
chown mohammed:nautilus_admin_users /opt/mohammed
chmod 700 /opt/mohammed

Modifying an Existing User

If the user already exists, update their configuration:

usermod -u 1403 -d /opt/mohammed -g nautilus_admin_users mohammed
mkdir -p /opt/mohammed
chown mohammed:nautilus_admin_users /opt/mohammed

Setting User Shell

To specify a custom shell for the user:

useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users -s /bin/bash mohammed

Troubleshooting

User Already Exists

If the user already exists, modify the existing user account:

usermod -u 1403 -d /opt/mohammed -g nautilus_admin_users mohammed
mkdir -p /opt/mohammed
chown mohammed:nautilus_admin_users /opt/mohammed

Group Already Exists

If the group already exists, proceed with user creation:

useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users mohammed

Permission Issues

Ensure proper sudo privileges:

sudo su -
# or use sudo with the command
sudo useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users mohammed

Invalid UID Error

Verify the UID is valid and not in use:

cut -d: -f3 /etc/passwd | sort -n

Home Directory Not Created

Create and set permissions manually:

mkdir -p /opt/mohammed
chown mohammed:nautilus_admin_users /opt/mohammed
chmod 700 /opt/mohammed

Security Considerations

After creating the user, consider implementing these additional security measures:

Set User Password

passwd mohammed

Configure Password Expiry

chage -E 2027-12-31 mohammed

Set Appropriate Home Directory Permissions

chmod 700 /opt/mohammed
chown -R mohammed:nautilus_admin_users /opt/mohammed

Restrict Shell Access

For service accounts, set a restricted shell:

usermod -s /sbin/nologin mohammed

Automated Script

For repeatable deployments, save this as create_user.sh:

#!/bin/bash

echo "Creating User mohammed on App Server 3"

ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
groupadd nautilus_admin_users 2>/dev/null
useradd -u 1403 -d /opt/mohammed -m -g nautilus_admin_users mohammed 2>/dev/null

echo "Verification Results:"
id mohammed
ls -ld /opt/mohammed
groups mohammed
grep mohammed /etc/passwd
grep nautilus_admin_users /etc/group
'
EOF

Make the script executable and run:

chmod +x create_user.sh
./create_user.sh

Summary

The user mohammed has been successfully created on App Server 3 (stapp03) in the Stratos Datacenter. The configuration includes:

Username: mohammed
UID: 1403
Home Directory: /opt/mohammed
Primary Group: nautilus_admin_users
Shell: /bin/bash (default)

The home directory has been created with appropriate ownership and permissions. The user is now ready for use on App Server 3 with all specified requirements satisfied. Verification commands confirm the user exists, the UID is correct, the home directory is properly configured, and the user is a member of the correct group.

SElinux Installation and Configuration

Janak Shrestha — Sat, 29 Aug 2026 05:29:11 +0000

Following a security audit, the xFusionCorp Industries security team has opted to enhance application and server security with SELinux. To initiate testing, the following requirements have been established for App server 2 in the Stratos Datacenter:

Install the required SELinux packages.

Permanently disable SELinux for the time being; it will be re-enabled after necessary configuration changes.

No need to reboot the server, as a scheduled maintenance reboot is already planned for tonight.

Disregard the current status of SELinux via the command line; the final status after the reboot should be disabled.

Solution

Step 1: Connect to App Server 2 (stapp02)

ssh steve@stapp02
# Password: Am3ric@

Step 2: Switch to root or use sudo

sudo su -
# Password: Am3ric@

Step 3: Install SELinux packages (if not already installed)

# Check if SELinux packages are installed
rpm -qa | grep selinux

# Install SELinux packages
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

Step 4: Check current SELinux status

# Check current SELinux status
getenforce
sestatus

Step 5: Permanently disable SELinux

# Edit the SELinux configuration file
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
# or
sed -i 's/SELINUX=permissive/SELINUX=disabled/g' /etc/selinux/config

# If SELINUX line doesn't exist, add it
grep -q "^SELINUX=" /etc/selinux/config || echo "SELINUX=disabled" >> /etc/selinux/config

Step 6: Verify the configuration

# Check the config file
cat /etc/selinux/config

# Verify SELINUX is set to disabled
grep "^SELINUX=" /etc/selinux/config

# Current status (will still show enforcing/permissive until reboot)
getenforce
sestatus

Step 7: Set SELinux to permissive mode (optional, for testing)

# This makes the system permissive until reboot
setenforce 0

# Verify it's now permissive
getenforce

Complete One-Line Commands

From jump host with password:

echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'yum install -y selinux-policy selinux-policy-targeted libselinux-utils && sed -i \"s/SELINUX=enforcing/SELINUX=disabled/g\" /etc/selinux/config && sed -i \"s/SELINUX=permissive/SELINUX=disabled/g\" /etc/selinux/config && grep SELINUX= /etc/selinux/config'"

Using heredoc (Recommended):

ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "=== Installing SELinux packages ==="
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

echo ""
echo "=== Current SELinux status ==="
getenforce
sestatus

echo ""
echo "=== Configuring SELinux to be disabled ==="
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
sed -i "s/SELINUX=permissive/SELINUX=disabled/g" /etc/selinux/config

# Ensure SELINUX is set to disabled
if ! grep -q "^SELINUX=disabled" /etc/selinux/config; then
    sed -i "s/^SELINUX=.*/SELINUX=disabled/g" /etc/selinux/config
fi

echo ""
echo "=== Verifying configuration ==="
grep "^SELINUX=" /etc/selinux/config

echo ""
echo "=== Setting SELinux to permissive mode (current session) ==="
setenforce 0

echo ""
echo "=== Current SELinux status (will be permissive until reboot) ==="
getenforce

echo ""
echo "✅ SELinux has been permanently disabled"
echo "⚠️  Current status: $(getenforce) (will change to disabled after reboot)"
echo "ℹ️  Configuration file: /etc/selinux/config"
echo "ℹ️  SELINUX=disabled will take effect after reboot"
'
EOF

Step-by-Step Interactive Commands

# Connect to stapp02
ssh steve@stapp02
# Enter password: Am3ric@

# Become root
sudo su -
# Enter password: Am3ric@

# Step 1: Check if SELinux packages are installed
echo "=== Checking SELinux packages ==="
rpm -qa | grep selinux

# Step 2: Install SELinux packages
echo "=== Installing SELinux packages ==="
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

# Step 3: Check current SELinux status
echo "=== Current SELinux status ==="
getenforce
sestatus

# Step 4: View current SELinux config
echo "=== Current SELinux config ==="
cat /etc/selinux/config

# Step 5: Permanently disable SELinux
echo "=== Disabling SELinux permanently ==="
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
sed -i 's/SELINUX=permissive/SELINUX=disabled/g' /etc/selinux/config

# If the line doesn't exist, add it
if ! grep -q "^SELINUX=" /etc/selinux/config; then
    echo "SELINUX=disabled" >> /etc/selinux/config
fi

# Step 6: Verify the configuration
echo "=== Verified SELinux config ==="
grep "^SELINUX=" /etc/selinux/config

# Step 7: Set SELinux to permissive for current session (optional)
echo "=== Setting SELinux to permissive mode (current session) ==="
setenforce 0

# Step 8: Check current status
echo "=== Current SELinux status ==="
getenforce
sestatus

# Step 9: Show final configuration
echo "=== Final configuration ==="
echo "SELINUX is set to: $(grep ^SELINUX= /etc/selinux/config | cut -d= -f2)"
echo "Current SELinux mode: $(getenforce)"

# Exit back
exit
exit

Expected Output

[root@stapp02 ~]# yum install -y selinux-policy selinux-policy-targeted libselinux-utils
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Package selinux-policy-3.14.3-80.el8.noarch already installed and latest version
Package selinux-policy-targeted-3.14.3-80.el8.noarch already installed and latest version
Package libselinux-utils-2.9-5.el8.x86_64 already installed and latest version
Nothing to do

[root@stapp02 ~]# getenforce
Enforcing

[root@stapp02 ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

[root@stapp02 ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

[root@stapp02 ~]# grep ^SELINUX= /etc/selinux/config
SELINUX=disabled

[root@stapp02 ~]# setenforce 0
[root@stapp02 ~]# getenforce
Permissive

[root@stapp02 ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          disabled
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

Alternative Methods

Method 1: Using echo to overwrite (if using a different approach)

# Update the config file directly
echo "SELINUX=disabled" > /etc/selinux/config
echo "SELINUXTYPE=targeted" >> /etc/selinux/config

Method 2: Using sed with backup

# Create backup and modify
cp /etc/selinux/config /etc/selinux/config.backup
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

Method 3: Using awk to replace

awk '/^SELINUX=/ {print "SELINUX=disabled"; next} {print}' /etc/selinux/config > /tmp/selinux_config
mv /tmp/selinux_config /etc/selinux/config

Method 4: Using systemd to disable SELinux (alternative)

# Add kernel parameter to disable SELinux
grubby --update-kernel ALL --args "selinux=0"

Verification Commands

# 1. Check SELinux config file
cat /etc/selinux/config | grep -E "^SELINUX=|^SELINUXTYPE="

# 2. Check current SELinux status
getenforce
sestatus

# 3. Check SELinux packages
rpm -qa | grep selinux

# 4. Check kernel boot parameters (for future verification)
grubby --info=ALL | grep selinux

# 5. Check if SELinux is disabled in the config
grep -q "^SELINUX=disabled" /etc/selinux/config && echo "SELINUX is disabled in config" || echo "SELINUX is not disabled in config"

# 6. Check current mode and config mode
echo "Current mode: $(getenforce)"
echo "Config mode: $(grep ^SELINUX= /etc/selinux/config | cut -d= -f2)"

# 7. Verify no reboot is needed for config change
echo "Configuration updated. Reboot needed for full disable."
echo "Current session is in $(getenforce) mode."

Understanding SELinux Modes

Mode	Description	Behavior
Enforcing	SELinux is active and enforcing security policies	Access denied if not allowed
Permissive	SELinux is active but only logs violations	Access allowed, but violations logged
Disabled	SELinux is completely turned off	No SELinux checks or logging

SELinux Status Overview

# View the current SELinux status
getenforce

# View detailed SELinux status
sestatus

# View SELinux config file
cat /etc/selinux/config

# Explanation of the config file:
# SELINUX=enforcing|permissive|disabled  - Sets the mode
# SELINUXTYPE=targeted|mls|minimum       - Sets the policy type

Troubleshooting

"No package selinux-policy available":

   # Try installing with different package names
   yum install -y selinux-policy-targeted selinux-policy
   # For Ubuntu/Debian
   apt-get install -y selinux-basics selinux-policy-default

"Permission denied" when editing config:

   # Use sudo or become root
   sudo su -

"setenforce: SELinux is disabled":

   # SELinux is already disabled in config, but currently in enforcing/permissive
   # Just reboot to fully disable
   # Or set to permissive temporarily

Config changes not taking effect:

   # Check the config file content
   cat /etc/selinux/config
   # Ensure there are no duplicate entries
   # If duplicate, remove old entries

Need to temporarily re-enable SELinux:

   # To test with SELinux enabled temporarily
   setenforce 1
   # Or permanently enable
   sed -i 's/SELINUX=disabled/SELINUX=enforcing/g' /etc/selinux/config

Complete Script (Run from Jump Host)

#!/bin/bash

echo "========================================="
echo "Installing SELinux and Disabling it Permanently"
echo "========================================="

ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo ""
echo "=== Step 1: Installing SELinux Packages ==="
yum install -y selinux-policy selinux-policy-targeted libselinux-utils

echo ""
echo "=== Step 2: Checking Current Status ==="
echo "Current mode: $(getenforce)"
echo "Config mode: $(grep ^SELINUX= /etc/selinux/config 2>/dev/null | cut -d= -f2)"

echo ""
echo "=== Step 3: Disabling SELinux Permanently ==="
# Backup original config
cp /etc/selinux/config /etc/selinux/config.backup

# Modify SELINUX setting
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
sed -i "s/SELINUX=permissive/SELINUX=disabled/g" /etc/selinux/config

# Ensure it's set to disabled
if ! grep -q "^SELINUX=disabled" /etc/selinux/config; then
    sed -i "s/^SELINUX=.*/SELINUX=disabled/g" /etc/selinux/config
fi

echo ""
echo "=== Step 4: Verifying Configuration ==="
grep ^SELINUX= /etc/selinux/config

echo ""
echo "=== Step 5: Setting Current Session to Permissive ==="
setenforce 0

echo ""
echo "=== Step 6: Final Status ==="
echo "Current mode: $(getenforce)"
echo "Config mode: $(grep ^SELINUX= /etc/selinux/config | cut -d= -f2)"

echo ""
echo "========================================="
echo "✅ SELinux configuration completed!"
echo "📌 Current mode: $(getenforce)"
echo "📌 After reboot: Disabled"
echo "📌 Config file: /etc/selinux/config"
echo "📌 Backup file: /etc/selinux/config.backup"
echo "========================================="
'
EOF

Make it executable and run:

chmod +x setup_selinux.sh
./setup_selinux.sh

Important Notes

No reboot required: The task specifically says no reboot is needed
Current vs After Reboot:
- Current status may still show enforcing or permissive
- After reboot, SELinux will be fully disabled
Setenforce 0: This sets SELinux to permissive mode until reboot
Configuration file: /etc/selinux/config controls the permanent setting
Backup created: Always good to backup configuration before changes

Complete Solution Summary

SELinux has been configured on App Server 2 (stapp02):

✅ SELinux packages installed: selinux-policy, selinux-policy-targeted, libselinux-utils
✅ Configuration updated: /etc/selinux/config set to SELINUX=disabled
✅ Current session set to permissive: setenforce 0 (optional but helpful)
✅ Verified configuration: grep ^SELINUX= /etc/selinux/config
✅ No reboot performed: As per requirements
✅ After reboot: SELinux will be completely disabled

The server is now configured with SELinux packages installed and permanently disabled. After tonight's scheduled maintenance reboot, SELinux will be fully disabled on App Server 2.

Process Limit Adjustment

Janak Shrestha — Sat, 29 Aug 2026 05:26:42 +0000

In the Stratos Datacenter, our application server 1 is encountering performance degradation due to excessive processes held by the nfsuser user. To mitigate this issue, we need to enforce limitations on its maximum processes. Please set the maximum process limits as specified below:

a. Set the soft limit to 1025
b. Set the hard limit to 2027

Solution

Step 1: Connect to App Server 1 (stapp01)

ssh tony@stapp01
# Password: Ir0nM@n

Step 2: Switch to root or use sudo

sudo su -
# Password: Ir0nM@n

Step 3: Check current limits for nfsuser

# Check current process limits for nfsuser
su - nfsuser -c "ulimit -u"

# Check all limits for nfsuser
su - nfsuser -c "ulimit -a"

Step 4: Set limits in /etc/security/limits.conf

# Add limits for nfsuser
echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

Step 5: Verify the configuration

# Check the limits.conf file
tail -5 /etc/security/limits.conf

# Verify the limits are applied (may need new session)
su - nfsuser -c "ulimit -u"

Complete One-Line Commands

From jump host with password:

echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'echo \"nfsuser soft nproc 1025\" >> /etc/security/limits.conf && echo \"nfsuser hard nproc 2027\" >> /etc/security/limits.conf && tail -5 /etc/security/limits.conf'"

Using heredoc (Recommended):

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "=== Current limits for nfsuser ==="
su - nfsuser -c "ulimit -u"

echo ""
echo "=== Adding limits to /etc/security/limits.conf ==="
echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

echo ""
echo "=== Verifying limits.conf ==="
tail -5 /etc/security/limits.conf

echo ""
echo "=== Verifying new limits for nfsuser ==="
su - nfsuser -c "ulimit -u"
'
EOF

Step-by-Step Interactive Commands

# Connect to stapp01
ssh tony@stapp01
# Enter password: Ir0nM@n

# Become root
sudo su -
# Enter password: Ir0nM@n

# Step 1: Check current limits
echo "=== Current process limits for nfsuser ==="
su - nfsuser -c "ulimit -u"

# Step 2: View current limits.conf
echo "=== Current /etc/security/limits.conf ==="
cat /etc/security/limits.conf

# Step 3: Add soft limit (1025) and hard limit (2027)
echo "=== Adding limits for nfsuser ==="
echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

# Step 4: Verify the entries
echo "=== New entries in limits.conf ==="
tail -5 /etc/security/limits.conf

# Step 5: Check if limits are applied
echo "=== Verifying limits for nfsuser ==="
su - nfsuser -c "ulimit -u"

# Step 6: Check all limits for nfsuser
echo "=== All limits for nfsuser ==="
su - nfsuser -c "ulimit -a"

# Exit back
exit
exit

Alternative Configuration Methods

Method 1: Using /etc/security/limits.d/ (Recommended for modular config)

# Create a separate file for nfsuser limits
echo "nfsuser soft nproc 1025" > /etc/security/limits.d/nfsuser.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.d/nfsuser.conf

# Verify
cat /etc/security/limits.d/nfsuser.conf

Method 2: Using PAM configuration (for system-wide)

# Check PAM configuration
cat /etc/pam.d/system-auth | grep pam_limits
# Ensure pam_limits.so is included

Method 3: Using systemd user limits (for services)

# For systemd services, create drop-in directory
mkdir -p /etc/systemd/system/user@.service.d/
echo "[Service]" > /etc/systemd/system/user@.service.d/limits.conf
echo "TasksMax=2027" >> /etc/systemd/system/user@.service.d/limits.conf
echo "LimitNPROC=2027" >> /etc/systemd/system/user@.service.d/limits.conf
systemctl daemon-reload

Verification Commands

# 1. Check limits.conf
grep -E "^nfsuser" /etc/security/limits.conf

# 2. Check limits.d directory
ls -la /etc/security/limits.d/
cat /etc/security/limits.d/nfsuser.conf 2>/dev/null

# 3. Check limits for nfsuser (as nfsuser)
su - nfsuser -c "ulimit -u"
# Should show: 1025 (soft limit)

# 4. Check hard limit as nfsuser
su - nfsuser -c "ulimit -u -H"
# Should show: 2027 (hard limit)

# 5. Check all limits for nfsuser
su - nfsuser -c "ulimit -a"

# 6. Check current processes for nfsuser
ps -u nfsuser | wc -l

# 7. Check if limits are applied
cat /proc/sys/kernel/threads-max  # System-wide max threads

Understanding ulimit Options

Option	Description
`-u`	Maximum number of user processes
`-H`	Hard limit (cannot be increased)
`-S`	Soft limit (can be increased up to hard limit)
`-a`	Show all current limits

Soft vs Hard Limits

Soft Limit: The current limit that can be increased by the user up to the hard limit
Hard Limit: The maximum limit that cannot be exceeded, set by root

Expected Output

[root@stapp01 ~]# su - nfsuser -c "ulimit -u"
1024

[root@stapp01 ~]# echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
[root@stapp01 ~]# echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

[root@stapp01 ~]# tail -5 /etc/security/limits.conf
# End of file
nfsuser soft nproc 1025
nfsuser hard nproc 2027

[root@stapp01 ~]# su - nfsuser -c "ulimit -u"
1025

[root@stapp01 ~]# su - nfsuser -c "ulimit -u -H"
2027

Troubleshooting

"su: user nfsuser does not exist":

   # Create the user first
   useradd nfsuser
   # Then set limits

Limits not being applied:

   # Check PAM configuration
   grep pam_limits.so /etc/pam.d/system-auth
   # Ensure session required pam_limits.so is present

   # Restart the session or login again
   su - nfsuser

"Permission denied":

   # Use sudo or become root
   sudo su -

Check if limits are too low:

   # Check current usage
   ps -u nfsuser --no-headers | wc -l
   # Ensure limit is higher than current usage

Apply limits without reboot:

   # For existing sessions, need to re-login
   pkill -u nfsuser
   # Or restart services
   systemctl restart [service-name]

Complete Script (Run from Jump Host)

#!/bin/bash

echo "========================================="
echo "Setting Process Limits for nfsuser"
echo "========================================="

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo ""
echo "=== Current Limits ==="
su - nfsuser -c "ulimit -u"

echo ""
echo "=== Adding limits to limits.conf ==="
if grep -q "^nfsuser" /etc/security/limits.conf; then
    echo "Removing existing nfsuser entries..."
    sed -i '/^nfsuser/d' /etc/security/limits.conf
fi

echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

echo ""
echo "=== New limits in limits.conf ==="
grep ^nfsuser /etc/security/limits.conf

echo ""
echo "=== Verifying Limits ==="
echo "Soft limit: $(su - nfsuser -c "ulimit -u")"
echo "Hard limit: $(su - nfsuser -c "ulimit -u -H")"

echo ""
echo "✅ Process limits set successfully!"
'
EOF

Make it executable and run:

chmod +x set_process_limits.sh
./set_process_limits.sh

Important Notes

New sessions required: Limits are applied only to new login sessions
Existing processes: Running processes won't be affected
User must exist: Ensure nfsuser user exists before setting limits
Systemd services: For systemd services, additional configuration may be needed

Complete Solution Summary

The process limits for nfsuser have been configured on App Server 1 (stapp01):

✅ Soft limit: 1025 (nfsuser soft nproc 1025)
✅ Hard limit: 2027 (nfsuser hard nproc 2027)
✅ Configuration added to /etc/security/limits.conf
✅ Verified using ulimit -u and ulimit -u -H
✅ Limits will apply to new sessions

These limits will prevent the nfsuser user from creating excessive processes, mitigating the performance degradation issue on Application Server 1.

Firewall Configuration

Janak Shrestha — Sat, 29 Aug 2026 05:25:20 +0000

The Nautilus system administrators team has rolled out a web UI application for their backup utility on the Nautilus application server 1 within the Stratos Datacenter. This application runs on port 3002and appropriate firewall rules must be configured to allow incoming traffic. To achieve this, firewalld needs to be installed and configured on the application server. To ensure proper functionality, the following requirements have been identified:

Install and enable the firewalld service.
Allow all incoming connections on port 3002/tcp.
Ensure the zone is set to public.

Solution

Step 1: Connect to App Server 1 (stapp01)

ssh tony@stapp01
# Password: Ir0nM@n

Step 2: Switch to root or use sudo

sudo su -
# Password: Ir0nM@n

Step 3: Install firewalld (if not already installed)

# Check if firewalld is installed
rpm -qa | grep firewalld

# If not installed, install it
yum install -y firewalld
# or for Ubuntu/Debian (if applicable)
# apt-get install -y firewalld

Step 4: Start and enable firewalld service

# Start firewalld service
systemctl start firewalld

# Enable firewalld to start on boot
systemctl enable firewalld

# Verify status
systemctl status firewalld

Step 5: Set zone to public

# Check current default zone
firewall-cmd --get-default-zone

# Set default zone to public
firewall-cmd --set-default-zone=public

# Verify zone
firewall-cmd --get-default-zone

Step 6: Allow port 3002/tcp

# Add port 3002/tcp to public zone
firewall-cmd --zone=public --add-port=3002/tcp --permanent

# Reload firewall to apply changes
firewall-cmd --reload

# Verify the rule is added
firewall-cmd --zone=public --list-ports

Step 7: Verify all configurations

# Check firewall status
systemctl status firewalld

# Check default zone
firewall-cmd --get-default-zone

# List all open ports
firewall-cmd --zone=public --list-all

# Check if port 3002 is allowed
firewall-cmd --zone=public --query-port=3002/tcp

Complete One-Line Commands

From jump host with password:

echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'yum install -y firewalld && systemctl start firewalld && systemctl enable firewalld && firewall-cmd --set-default-zone=public && firewall-cmd --zone=public --add-port=3002/tcp --permanent && firewall-cmd --reload && firewall-cmd --zone=public --list-all'"

Using heredoc (Recommended):

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "=== Installing firewalld ==="
yum install -y firewalld

echo "=== Starting and enabling firewalld ==="
systemctl start firewalld
systemctl enable firewalld

echo "=== Setting zone to public ==="
firewall-cmd --set-default-zone=public

echo "=== Allowing port 3002/tcp ==="
firewall-cmd --zone=public --add-port=3002/tcp --permanent
firewall-cmd --reload

echo "=== Verification ==="
firewall-cmd --zone=public --list-all
'
EOF

Step-by-Step Interactive Commands

# Connect to stapp01
ssh tony@stapp01
# Enter password: Ir0nM@n

# Become root
sudo su -
# Enter password: Ir0nM@n

# Step 1: Check if firewalld is installed
echo "=== Checking if firewalld is installed ==="
rpm -qa | grep firewalld

# Step 2: Install firewalld if not present
echo "=== Installing firewalld ==="
yum install -y firewalld

# Step 3: Start firewalld
echo "=== Starting firewalld ==="
systemctl start firewalld

# Step 4: Enable firewalld to start on boot
echo "=== Enabling firewalld ==="
systemctl enable firewalld

# Step 5: Check firewalld status
echo "=== Firewalld Status ==="
systemctl status firewalld

# Step 6: Set default zone to public
echo "=== Setting zone to public ==="
firewall-cmd --set-default-zone=public
firewall-cmd --get-default-zone

# Step 7: Allow port 3002/tcp permanently
echo "=== Allowing port 3002/tcp ==="
firewall-cmd --zone=public --add-port=3002/tcp --permanent

# Step 8: Reload firewall
echo "=== Reloading firewall ==="
firewall-cmd --reload

# Step 9: Verify port is open
echo "=== Verifying open ports ==="
firewall-cmd --zone=public --list-ports

# Step 10: Show complete configuration
echo "=== Complete Firewall Configuration ==="
firewall-cmd --zone=public --list-all

# Exit
exit
exit

Expected Output

[root@stapp01 ~]# yum install -y firewalld
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Package firewalld-0.9.3-13.el8.noarch already installed and latest version
Nothing to do

[root@stapp01 ~]# systemctl start firewalld
[root@stapp01 ~]# systemctl enable firewalld
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

[root@stapp01 ~]# firewall-cmd --set-default-zone=public
success

[root@stapp01 ~]# firewall-cmd --zone=public --add-port=3002/tcp --permanent
success

[root@stapp01 ~]# firewall-cmd --reload
success

[root@stapp01 ~]# firewall-cmd --zone=public --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: dhcpv6-client ssh
  ports: 3002/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

[root@stapp01 ~]# firewall-cmd --zone=public --query-port=3002/tcp
yes

Additional Verification Commands

# Check if firewalld is running
systemctl is-active firewalld
# Should output: active

# Check if firewalld is enabled for boot
systemctl is-enabled firewalld
# Should output: enabled

# List all zones
firewall-cmd --get-zones

# List all open ports in public zone
firewall-cmd --zone=public --list-ports

# List all services in public zone
firewall-cmd --zone=public --list-services

# Check if specific port is open
firewall-cmd --zone=public --query-port=3002/tcp

# View rich rules
firewall-cmd --zone=public --list-rich-rules

# Check firewall state
firewall-cmd --state
# Should output: running

# View the current configuration
firewall-cmd --list-all

Troubleshooting

"firewalld: command not found":

   # Install firewalld
   yum install -y firewalld
   # or
   apt-get install -y firewalld

"Failed to start firewalld":

   # Check for errors
   journalctl -u firewalld
   # Stop and restart
   systemctl stop firewalld
   systemctl start firewalld

"FirewallD is not running":

   # Start firewalld
   systemctl start firewalld
   # Check status
   systemctl status firewalld

"Error: COMMAND_FAILED":

   # Use --permanent flag and reload
   firewall-cmd --zone=public --add-port=3002/tcp --permanent
   firewall-cmd --reload

"Zone public not available":

   # List available zones
   firewall-cmd --get-zones
   # Set a different zone if needed

"Failed to set default zone":

   # Check if firewalld is running
   systemctl status firewalld
   # Restart firewalld
   systemctl restart firewalld

Firewalld Commands Reference

Service Management

systemctl start firewalld    # Start firewalld
systemctl stop firewalld     # Stop firewalld
systemctl restart firewalld  # Restart firewalld
systemctl status firewalld   # Check status
systemctl enable firewalld   # Enable on boot
systemctl disable firewalld  # Disable on boot

Zone Management

firewall-cmd --get-default-zone              # Get default zone
firewall-cmd --set-default-zone=public       # Set default zone
firewall-cmd --get-zones                     # List all zones
firewall-cmd --list-all                      # List all rules

Port Management

firewall-cmd --zone=public --add-port=3002/tcp --permanent   # Add port
firewall-cmd --zone=public --remove-port=3002/tcp --permanent  # Remove port
firewall-cmd --zone=public --list-ports                      # List ports
firewall-cmd --zone=public --query-port=3002/tcp            # Query port
firewall-cmd --reload                                        # Reload rules

Service Management

firewall-cmd --zone=public --add-service=http --permanent    # Add service
firewall-cmd --zone=public --remove-service=http --permanent # Remove service
firewall-cmd --zone=public --list-services                   # List services

Complete Script (Run from Jump Host)

Create a script setup_firewall.sh:

#!/bin/bash

echo "========================================="
echo "Installing and Configuring Firewalld"
echo "========================================="

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo ""
echo "=== Step 1: Installing firewalld ==="
yum install -y firewalld

echo ""
echo "=== Step 2: Starting firewalld ==="
systemctl start firewalld
systemctl enable firewalld

echo ""
echo "=== Step 3: Setting default zone to public ==="
firewall-cmd --set-default-zone=public

echo ""
echo "=== Step 4: Allowing port 3002/tcp ==="
firewall-cmd --zone=public --add-port=3002/tcp --permanent
firewall-cmd --reload

echo ""
echo "=== Step 5: Verification ==="
echo "Firewalld Status:"
systemctl status firewalld | grep -E "Active|Loaded"

echo ""
echo "Default Zone:"
firewall-cmd --get-default-zone

echo ""
echo "Open Ports:"
firewall-cmd --zone=public --list-ports

echo ""
echo "Complete Configuration:"
firewall-cmd --zone=public --list-all

echo ""
echo "✅ Firewalld configured successfully!"
'
EOF

Make it executable and run:

chmod +x setup_firewall.sh
./setup_firewall.sh

Security Best Practices

Allow only specific IPs (if needed):

   firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port protocol="tcp" port="3002" accept' --permanent

Limit source IPs for security:

   firewall-cmd --zone=public --add-source=10.0.0.0/8 --permanent

Verify after reboot:

   systemctl reboot
   # After reboot, verify
   systemctl status firewalld
   firewall-cmd --zone=public --list-ports

Complete Solution Summary

The firewall has been configured on App Server 1 (stapp01):

✅ firewalld installed: yum install -y firewalld
✅ firewalld started: systemctl start firewalld
✅ firewalld enabled on boot: systemctl enable firewalld
✅ Default zone set to public: firewall-cmd --set-default-zone=public
✅ Port 3002/tcp allowed permanently: firewall-cmd --zone=public --add-port=3002/tcp --permanent
✅ Firewall reloaded: firewall-cmd --reload
✅ Configuration verified: Port 3002 is open and accessible

The Nautilus backup utility web UI application running on port 3002 can now accept incoming connections through the firewall.

Timezone Alignment

Janak Shrestha — Sat, 29 Aug 2026 05:23:29 +0000

In the daily standup, it was noted that the timezone settings across the Nautilus Application Servers in the Stratos Datacenter are inconsistent with the local datacenter's timezone, currently set to America/Blanc-Sablon.

Synchronize the timezone settings to match the local datacenter's timezone (America/Blanc-Sablon)

Prerequisites
Manual Configuration Steps
Automated One-Line Commands
Complete Script Implementation
Verification Procedures
Alternative Methods
Troubleshooting Guide
Timezone Information

Prerequisites

SSH access to all application servers
Sudo privileges on each server
Server credentials:
- stapp01: User tony / Password Ir0nM@n
- stapp02: User steve / Password Am3ric@
- stapp03: User banner / Password BigGr33n

Manual Configuration Steps

Step 1: Connect to Each Application Server

# App Server 1
ssh tony@stapp01

# App Server 2
ssh steve@stapp02

# App Server 3
ssh banner@stapp03

Step 2: Check Current Timezone

# Using timedatectl
timedatectl

# Using date command
date

# Check timezone configuration file
cat /etc/timezone 2>/dev/null || cat /etc/sysconfig/clock 2>/dev/null

Step 3: Set Timezone to America/Blanc-Sablon

Method 1: Using timedatectl (Recommended)

sudo timedatectl set-timezone America/Blanc-Sablon

Method 2: Using Symbolic Link

sudo ln -sf /usr/share/zoneinfo/America/Blanc-Sablon /etc/localtime

Method 3: Using tzdata (Debian/Ubuntu)

echo "America/Blanc-Sablon" | sudo tee /etc/timezone
sudo dpkg-reconfigure --frontend noninteractive tzdata

Step 4: Verify the Change

# Check updated timezone
timedatectl

# Verify with date command
date

# Check symbolic link
ls -la /etc/localtime

# Verify timezone file
cat /etc/timezone 2>/dev/null || cat /etc/sysconfig/clock 2>/dev/null

# Detailed status
timedatectl status

Step 5: Exit the Server

exit

Automated One-Line Commands

Complete Commands for All Servers

# stapp01
echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'timedatectl set-timezone America/Blanc-Sablon && timedatectl | grep \"Time zone\"'"

# stapp02
echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'timedatectl set-timezone America/Blanc-Sablon && timedatectl | grep \"Time zone\"'"

# stapp03
echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'timedatectl set-timezone America/Blanc-Sablon && timedatectl | grep \"Time zone\"'"

Why This Syntax Works

The command uses sudo -S bash -c 'cmd1 && cmd2' to pass the password once and execute multiple commands within a single sudo session. This avoids the issue where only the first sudo command receives the password.

Using Heredoc (More Detailed Output)

# stapp01
ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "Current timezone:"
timedatectl | grep "Time zone"
echo ""
echo "Setting timezone to America/Blanc-Sablon..."
timedatectl set-timezone America/Blanc-Sablon
echo ""
echo "New timezone:"
timedatectl | grep "Time zone"
echo ""
date
'
EOF

# stapp02
ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "Current timezone:"
timedatectl | grep "Time zone"
echo ""
echo "Setting timezone to America/Blanc-Sablon..."
timedatectl set-timezone America/Blanc-Sablon
echo ""
echo "New timezone:"
timedatectl | grep "Time zone"
echo ""
date
'
EOF

# stapp03
ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Current timezone:"
timedatectl | grep "Time zone"
echo ""
echo "Setting timezone to America/Blanc-Sablon..."
timedatectl set-timezone America/Blanc-Sablon
echo ""
echo "New timezone:"
timedatectl | grep "Time zone"
echo ""
date
'
EOF

Complete Script Implementation

Create a script file named set_timezone.sh:

#!/bin/bash

# Define servers with their credentials
declare -A SERVERS=(
    ["stapp01"]="tony:Ir0nM@n"
    ["stapp02"]="steve:Am3ric@"
    ["stapp03"]="banner:BigGr33n"
)

TIMEZONE="America/Blanc-Sablon"

echo "========================================="
echo "Synchronizing Timezone to $TIMEZONE"
echo "========================================="

for server in "${!SERVERS[@]}"; do
    IFS=':' read -r user pass <<< "${SERVERS[$server]}"
    echo ""
    echo "-----------------------------------------"
    echo "Processing $server (User: $user)"
    echo "-----------------------------------------"

    sshpass -p "$pass" ssh -o StrictHostKeyChecking=no "$user@$server" "sudo -S bash -c '
        echo \"Current timezone:\"
        timedatectl | grep \"Time zone\"

        echo \"Setting timezone to $TIMEZONE...\"
        timedatectl set-timezone $TIMEZONE

        echo \"New timezone:\"
        timedatectl | grep \"Time zone\"

        echo \"Current date and time:\"
        date
    '"

    if [ $? -eq 0 ]; then
        echo "SUCCESS: $server completed successfully"
    else
        echo "ERROR: Failed to configure $server"
    fi
done

echo ""
echo "========================================="
echo "All App servers timezone synchronized"
echo "========================================="
echo ""
echo "Verification Commands:"
echo "  ssh tony@stapp01 'timedatectl | grep Time zone'"
echo "  ssh steve@stapp02 'timedatectl | grep Time zone'"
echo "  ssh banner@stapp03 'timedatectl | grep Time zone'"

Make the script executable and run:

chmod +x set_timezone.sh
./set_timezone.sh

Alternative Script Without sshpass

If sshpass is not available, use this version:

#!/bin/bash

TIMEZONE="America/Blanc-Sablon"

echo "========================================="
echo "Synchronizing Timezone to $TIMEZONE"
echo "========================================="

# stapp01
echo ""
echo "=== stapp01 ==="
ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "Setting timezone...";
timedatectl set-timezone America/Blanc-Sablon;
echo "Verification:";
timedatectl | grep "Time zone"
'
EOF

# stapp02
echo ""
echo "=== stapp02 ==="
ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "Setting timezone...";
timedatectl set-timezone America/Blanc-Sablon;
echo "Verification:";
timedatectl | grep "Time zone"
'
EOF

# stapp03
echo ""
echo "=== stapp03 ==="
ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Setting timezone...";
timedatectl set-timezone America/Blanc-Sablon;
echo "Verification:";
timedatectl | grep "Time zone"
'
EOF

echo ""
echo "========================================="
echo "All App servers timezone synchronized"
echo "========================================="

Verification Procedures

Verify Timezone on Each Server

# stapp01
ssh tony@stapp01 "echo 'Ir0nM@n' | sudo -S timedatectl | grep 'Time zone'"

# stapp02
ssh steve@stapp02 "echo 'Am3ric@' | sudo -S timedatectl | grep 'Time zone'"

# stapp03
ssh banner@stapp03 "echo 'BigGr33n' | sudo -S timedatectl | grep 'Time zone'"

Verify with Date Command

# stapp01
ssh tony@stapp01 "date"

# stapp02
ssh steve@stapp02 "date"

# stapp03
ssh banner@stapp03 "date"

Check Symbolic Links

# stapp01
ssh tony@stapp01 "ls -la /etc/localtime"

# stapp02
ssh steve@stapp02 "ls -la /etc/localtime"

# stapp03
ssh banner@stapp03 "ls -la /etc/localtime"

Combined Verification Command

echo "=== stapp01 ===" && ssh tony@stapp01 "echo 'Ir0nM@n' | sudo -S timedatectl | grep Time" && \
echo "=== stapp02 ===" && ssh steve@stapp02 "echo 'Am3ric@' | sudo -S timedatectl | grep Time" && \
echo "=== stapp03 ===" && ssh banner@stapp03 "echo 'BigGr33n' | sudo -S timedatectl | grep Time"

Expected Output

=== stapp01 ===
                Time zone: America/Blanc-Sablon (AST, -0400)
=== stapp02 ===
                Time zone: America/Blanc-Sablon (AST, -0400)
=== stapp03 ===
                Time zone: America/Blanc-Sablon (AST, -0400)

Alternative Methods

Method 1: Using ln Command (if timedatectl unavailable)

# Remove existing link
sudo rm -f /etc/localtime

# Create new link
sudo ln -sf /usr/share/zoneinfo/America/Blanc-Sablon /etc/localtime

Method 2: Using /etc/timezone (Debian/Ubuntu)

# Set timezone
echo "America/Blanc-Sablon" | sudo tee /etc/timezone

# Update system
sudo dpkg-reconfigure --frontend noninteractive tzdata

Method 3: Using /etc/sysconfig/clock (RHEL/CentOS)

# Set timezone in config
echo 'ZONE="America/Blanc-Sablon"' | sudo tee /etc/sysconfig/clock

# Create symbolic link
sudo ln -sf /usr/share/zoneinfo/America/Blanc-Sablon /etc/localtime

Method 4: Interactive Method (tzselect)

# This is interactive, not suitable for automation
tzselect
# Follow prompts to select America -> Blanc-Sablon

Method 5: With NTP Sync

# If NTP is enabled, timezone change may trigger time sync
sudo timedatectl set-timezone America/Blanc-Sablon
sudo timedatectl set-ntp true
sudo timedatectl set-timezone America/Blanc-Sablon

Troubleshooting Guide

Issue 1: "Failed to set timezone: Invalid timezone"

Solution: Verify the timezone exists in the system:

timedatectl list-timezones | grep -i blanc-sablon
# Should show: America/Blanc-Sablon

Issue 2: "Permission denied"

Solution: Use sudo or become root:

sudo timedatectl set-timezone America/Blanc-Sablon

Issue 3: "System has not been booted with systemd"

Solution: Use the ln command method instead:

sudo ln -sf /usr/share/zoneinfo/America/Blanc-Sablon /etc/localtime

Issue 4: Password not accepted in one-liner

Solution: Ensure the correct syntax with single sudo session:

# Incorrect - only first sudo gets password
echo 'pass' | sudo -S cmd1 && sudo -S cmd2

# Correct - single sudo session
echo 'pass' | sudo -S bash -c 'cmd1 && cmd2'

Issue 5: Time not updating after timezone change

Solution: Restart systemd-timesyncd or force time sync:

# Restart time synchronization service
sudo systemctl restart systemd-timesyncd

# Or force time sync
sudo timedatectl set-ntp false
sudo timedatectl set-ntp true

Issue 6: Multiple verification methods

# Check from multiple sources
timedatectl
date
cat /etc/timezone 2>/dev/null
cat /etc/sysconfig/clock 2>/dev/null
ls -la /etc/localtime

Issue 7: sshpass not installed

Solution: Install sshpass or use heredoc method:

# Install sshpass
sudo yum install -y sshpass  # RHEL/CentOS
sudo apt-get install -y sshpass  # Ubuntu/Debian

Timezone Information

America/Blanc-Sablon Details

Full Name: America/Blanc-Sablon
Standard Time: AST (Atlantic Standard Time)
UTC Offset: UTC-4
Daylight Saving Time: No DST observed
Location: Blanc-Sablon, Quebec, Canada
Major Cities: Blanc-Sablon, Quebec

Timezone Comparison

Timezone	UTC Offset	DST
America/Blanc-Sablon	UTC-4	No
America/New_York	UTC-4/UTC-5	Yes
America/Chicago	UTC-5/UTC-6	Yes
America/Denver	UTC-6/UTC-7	Yes
America/Los_Angeles	UTC-7/UTC-8	Yes

Summary

The timezone settings have been successfully synchronized on all Nautilus Application Servers:

stapp01: Timezone set to America/Blanc-Sablon
stapp02: Timezone set to America/Blanc-Sablon
stapp03: Timezone set to America/Blanc-Sablon

All servers now have consistent timezone settings matching the local datacenter's timezone (America/Blanc-Sablon). Verification has been completed using timedatectl and date commands, and the timezone symbolic links have been updated accordingly.

Quick Reference Card

Manual Setup

# Connect and set timezone
ssh tony@stapp01
sudo timedatectl set-timezone America/Blanc-Sablon
timedatectl
exit

One-Line Commands

# stapp01
echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'timedatectl set-timezone America/Blanc-Sablon && timedatectl | grep \"Time zone\"'"

# stapp02
echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'timedatectl set-timezone America/Blanc-Sablon && timedatectl | grep \"Time zone\"'"

# stapp03
echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'timedatectl set-timezone America/Blanc-Sablon && timedatectl | grep \"Time zone\"'"

Verification

# Quick verification
ssh tony@stapp01 "echo 'Ir0nM@n' | sudo -S timedatectl | grep Time"
ssh steve@stapp02 "echo 'Am3ric@' | sudo -S timedatectl | grep Time"
ssh banner@stapp03 "echo 'BigGr33n' | sudo -S timedatectl | grep Time"

Default GUI Boot Configuration

Janak Shrestha — Sat, 29 Aug 2026 03:39:33 +0000

With the installation of new tools on the app servers within the Stratos Datacenter, certain functionalities now necessitate graphical user interface (GUI) access.

Adjust the default runlevel on all App servers in Stratos Datacenter to enable GUI booting by default. It's imperative not to initiate a server reboot after completing this task.

Introduction

Managing system runlevels is a fundamental task for Linux system administrators. In modern Linux distributions using systemd, the traditional runlevel concept has been replaced with systemd targets. This guide demonstrates how to configure the default boot target to graphical mode across multiple servers without requiring immediate system reboots.

Understanding Systemd Targets and Runlevels

Systemd targets serve as synchronization points that group related services and units. The relationship between traditional runlevels and systemd targets is as follows:

Runlevel	Systemd Target	Description
0	poweroff.target	System halt
1	rescue.target	Single-user mode
3	multi-user.target	Multi-user text mode
5	graphical.target	Multi-user with GUI
6	reboot.target	System reboot

In this scenario, the App servers currently boot to multi-user.target (runlevel 3 - text mode) and need to be configured to boot to graphical.target (runlevel 5 - GUI mode).

Common Pitfall: Password Handling in Remote Execution

When executing multiple sudo commands remotely, a common issue arises where the password is only passed to the first sudo command. This results in authentication failures for subsequent commands.

Problematic Implementation

The following approach fails because the second sudo command receives no password input:

echo 'Password123' | ssh user@server "sudo -S systemctl set-default graphical.target && sudo -S systemctl get-default"

In this example, the first sudo command receives the password via the pipe, but the second sudo command has no password available and will prompt for input, causing the command to hang or fail.

Correct Implementation

The solution is to combine all commands into a single sudo session using either a shell wrapper or a heredoc approach. This ensures the password is passed once and all commands execute within the same privileged context.

Solution Methods

Method 1: Single Shell Session with Command Chaining

This method uses a shell wrapper to execute multiple commands within a single sudo session:

echo 'Password123' | ssh user@server "sudo -S bash -c 'systemctl set-default graphical.target && systemctl get-default'"

The bash -c wrapper creates a single shell process that executes both commands sequentially. The password is passed to the sudo command once, and both systemctl commands run with elevated privileges.

Method 2: Heredoc with Sudo Wrapper

The heredoc approach provides better readability for complex command sequences:

ssh user@server << 'EOF'
echo 'Password123' | sudo -S bash -c '
systemctl set-default graphical.target
systemctl get-default
'
EOF

This method is particularly useful when executing multiple commands or when the command sequence is lengthy and requires better formatting.

Method 3: Multiple Statements with Shell

This method chains multiple statements using a shell interpreter:

echo 'Password123' | ssh user@server "sudo -S sh -c 'systemctl set-default graphical.target && systemctl get-default'"

Using sh instead of bash provides compatibility with systems where bash is not the default shell.

Interactive Method

For administrators who prefer an interactive approach, the following steps can be performed on each server:

# 1. Connect to the server
ssh tony@stapp01  # or steve@stapp02 / banner@stapp03
# Enter password

# 2. Become root
sudo su -
# Enter password

# 3. Check current default target
systemctl get-default

# 4. Set default to graphical.target
systemctl set-default graphical.target

# 5. Verify the change
systemctl get-default

# 6. Check the symlink
ls -la /etc/systemd/system/default.target

# 7. Exit
exit
exit

Complete Implementation for Multiple Servers

Server Configuration Details

Server	Username	Password
stapp01	tony	Ir0nM@n
stapp02	steve	Am3ric@
stapp03	banner	BigGr33n

Single-Command Implementation

Execute the following commands from the jump host:

# stapp01 - App Server 1
echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'echo \"Current: $(systemctl get-default)\"; systemctl set-default graphical.target; echo \"New: $(systemctl get-default)\"'"

# stapp02 - App Server 2
echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'echo \"Current: $(systemctl get-default)\"; systemctl set-default graphical.target; echo \"New: $(systemctl get-default)\"'"

# stapp03 - App Server 3
echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'echo \"Current: $(systemctl get-default)\"; systemctl set-default graphical.target; echo \"New: $(systemctl get-default)\"'"

Heredoc Implementation for Better Readability

# stapp01
ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "Current default target: $(systemctl get-default)"
systemctl set-default graphical.target
echo "New default target: $(systemctl get-default)"
ls -la /etc/systemd/system/default.target
'
EOF

# stapp02
ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "Current default target: $(systemctl get-default)"
systemctl set-default graphical.target
echo "New default target: $(systemctl get-default)"
ls -la /etc/systemd/system/default.target
'
EOF

# stapp03
ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Current default target: $(systemctl get-default)"
systemctl set-default graphical.target
echo "New default target: $(systemctl get-default)"
ls -la /etc/systemd/system/default.target
'
EOF

Automated Configuration Script

Create a shell script named configure_gui_target.sh to automate the process across all servers:

#!/bin/bash

echo "========================================="
echo "Configuring GUI Boot Target on All Servers"
echo "========================================="

# stapp01
echo ""
echo "Processing stapp01"
ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "Current target: $(systemctl get-default)"
systemctl set-default graphical.target
echo "New target: $(systemctl get-default)"
ls -la /etc/systemd/system/default.target
'
EOF

# stapp02
echo ""
echo "Processing stapp02"
ssh steve@stapp02 << 'EOF'
echo 'Am3ric@' | sudo -S bash -c '
echo "Current target: $(systemctl get-default)"
systemctl set-default graphical.target
echo "New target: $(systemctl get-default)"
ls -la /etc/systemd/system/default.target
'
EOF

# stapp03
echo ""
echo "Processing stapp03"
ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Current target: $(systemctl get-default)"
systemctl set-default graphical.target
echo "New target: $(systemctl get-default)"
ls -la /etc/systemd/system/default.target
'
EOF

echo ""
echo "========================================="
echo "Configuration Complete"
echo "========================================="
echo ""
echo "Verification Commands:"
echo "  ssh tony@stapp01 'systemctl get-default'"
echo "  ssh steve@stapp02 'systemctl get-default'"
echo "  ssh banner@stapp03 'systemctl get-default'"

Make the script executable and run it:

chmod +x configure_gui_target.sh
./configure_gui_target.sh

Verification Commands

Verify the configuration on each server using the following commands:

# Check default target
ssh tony@stapp01 "echo 'Ir0nM@n' | sudo -S systemctl get-default"
ssh steve@stapp02 "echo 'Am3ric@' | sudo -S systemctl get-default"
ssh banner@stapp03 "echo 'BigGr33n' | sudo -S systemctl get-default"

# Expected output on all servers: graphical.target

For detailed verification on each server:

# Check default target
systemctl get-default

# Verify the symlink
ls -la /etc/systemd/system/default.target

# Check graphical target status
systemctl status graphical.target

# View all available targets
systemctl list-units --type=target --all | grep -E "graphical|multi-user"

# Check current runlevel
runlevel

# Verify no reboot occurred
uptime

Expected Output

When the configuration is applied successfully, you should see output similar to this:

Current default target: multi-user.target

Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/graphical.target.

New default target: graphical.target

lrwxrwxrwx 1 root root 37 Jul 10 10:00 /etc/systemd/system/default.target -> /usr/lib/systemd/system/graphical.target

Understanding the Changes

Before Change:

Default target: multi-user.target
Boots to text mode (runlevel 3)

After Change:

Default target: graphical.target
Will boot to GUI mode (runlevel 5) on next reboot

Key Differences:

Feature	multi-user.target	graphical.target
Boot Mode	Text/Console	Graphical/GUI
Display Manager	Not started	Started
X Server	Not running	Running
Memory Usage	Lower	Higher
Suitable for	Servers, headless	Workstations, desktops

Troubleshooting Common Issues

Issue 1: Permission Denied

If you encounter "Operation not permitted" errors:

# Ensure proper sudo usage
sudo systemctl set-default graphical.target

Issue 2: Graphical Target Not Found

If the graphical target is unavailable:

# Check if graphical target exists
systemctl status graphical.target

# Install GUI packages (RHEL/CentOS)
yum groupinstall "Server with GUI" -y

# For Debian/Ubuntu
apt-get install ubuntu-desktop -y

# Install X11 packages if needed
yum install -y xorg-x11-server-Xorg xorg-x11-drivers

Issue 3: Display Manager Not Installed

Install and enable a display manager:

# Check available display managers
systemctl list-unit-files | grep -E "gdm|lightdm|sddm|kdm"

# Install GDM
yum install -y gdm
systemctl enable gdm

# Install LightDM
yum install -y lightdm
systemctl enable lightdm

Issue 4: Reverting to Text Mode

If you need to revert the changes:

systemctl set-default multi-user.target

Understanding Systemd Target Dependencies

The graphical target depends on the multi-user target, which in turn depends on basic system services:

graphical.target
    └── multi-user.target
        └── basic.target
            └── sysinit.target
                └── local-fs.target
                    └── swap.target

To view all dependencies:

systemctl list-dependencies graphical.target

Alternative Commands

Using Legacy Runlevel Commands

# Check current runlevel
runlevel

# Set default runlevel to 5 (GUI) - Deprecated, use systemctl instead
# Edit /etc/inittab (for older systems)
# id:5:initdefault:

Using Systemd Numeric Runlevels

# Runlevel 5 = graphical.target
systemctl set-default runlevel5.target

# Runlevel 3 = multi-user.target
systemctl set-default runlevel3.target

Important Considerations

No Reboot Required: The changes take effect on the next system boot only. The current session remains unaffected.
GUI Packages Required: The graphical target requires appropriate display manager and X11 packages to be installed on the servers.
Current Session Unchanged: The server continues running in its current mode until rebooted.
Symlink Verification: The default target is configured via a symbolic link at /etc/systemd/system/default.target.
Password Security: The methods demonstrated pass passwords in plain text through the command line. In production environments, consider using SSH keys or password managers for improved security.

Complete Solution Summary

The default runlevel has been configured on all App servers:

stapp01: Default target changed to graphical.target
stapp02: Default target changed to graphical.target
stapp03: Default target changed to graphical.target
Verified using systemctl get-default on each server
Symlink created from /etc/systemd/system/default.target to graphical.target
No servers were rebooted as required
Changes will take effect on next reboot

Conclusion

Setting the default boot target to graphical mode across multiple Linux servers requires careful attention to password handling when executing remote sudo commands. By combining commands into a single sudo session using shell wrappers or heredoc syntax, system administrators can reliably configure the default target across all servers without encountering authentication issues.