So Ansible is the BIG thing at the moment, along with other configuration management solutions like Puppet, SaltStack and so on. At my company we are managing 500+ servers and some guys are implementing an Ansible solution to minimise the configuration management overhead.
Paranoid as I am, I started thinking about what can actually be done from an Ansible server if someone is not in their right mind.
I have searched online looking for best practices, for security hardening on Ansible servers and mostly I find articles of how Ansible can be used to harden other servers (obviously) and also I find general recommendations of how to harden a Linux server, since Ansible runs on Linux. So that got me thinking that the overall idea of having a centralised configuration management server comes with some risks; wouldn't I, as a hacker or disgruntled employee, be able to run the command
rm -rf / on all servers or similar using the Ansible server?
As a rule of thumb I would suppose that having a segmented network where test, dev, pre-prod, and prod are all unavailable to each other would mean that you would AT LEAST have an Ansible server installed for each of these environments, so you don't have a server where firewall allows access to all systems. I guess that's common sense at least.
However still, the idea of a server that can configure an ENTIRE NETWORK of servers is insane if you think about someone who's not supposed to, getting access to the Ansible server.
Would one create some kind of MFA that kicks in before commands are run, or would the Ansible server be unable to create its own playbooks, and then the playbooks are mounted from a readonly server elsewhere, so the possibilities of post exploitation at least require you to control more than just the Ansible server?
Do we put the Ansible server on a locked-the-f-down management network that is difficult for even employees to access with MFA, special access requirements, no VPN, only onsite access, and so on?
Or do we accept the risk and keep good backups and protect the network properly and accept that if the Ansible server is compromised, destruction could be imminent?
Or am I totally wrong about the destructive capabilities of Ansible?