As a SysAdmin, what’s your favorite tool?

I was noticing the same thing with larger scripts or playbooks and chatGPT just 'handwaving' the complicated parts. Example: **The prompt:** >Write me an Ansible playbook that deploys NRPE on remote servers with SSL encryption configuration. The playbook will also request a TLS encryption certificate from a certificate authority. The address of this certificate autority is fake-nagios.fake.internal - name: Send certificate request to CA uri: url: "https://{{ ca_address }}/request_certificate" method: POST body_format: json body: common_name: "{{ inventory_hostname }}" subject_alternative_names: "{{ ansible_all_ipv4_addresses }}" key_algorithm: rsa key_length: 2048 headers: Content-Type: "application/json" validate_certs: no status_code: 200 register: ca_response when: nrpe_ssl_cert is not defined and nrpe_ssl_key is not defined ChatGPT just said, *'I dunno, send a JSON payload with the server's inventory name and IP address to your CA and it'll take care of it from there.'* The prompt said nothing to indicate the CA server was configured to handle JSON payloads or even had a webserver associated with it. Later, I read about this[ security researcher who was able to create malware in chatGPT](https://www.techspot.com/news/98202-researcher-used-chatgpt-create-dangerous-data-stealing-malware.html) successfully by sticking to small, manageable chunks/functions of the code and assembling it himself. Once I started breaking down my chatGPT requests into smaller, more specific prompts my return on effort increased significantly. **Updated, more specific prompt:** >Write an Ansible playbook to request a TLS certificate for a given Ansible host from a certificate authority(CA) server. The CA server is called fake-nagios. The CA server is running openssl 1.0.2, CSR requests for the Ansible host must be made locally on the CA server. Certificates generated from the CSR must then be copied over to the Ansible host. Which provided: tasks: - name: Copy CSR to CA server copy: src: /path/to/csr/{{ inventory_hostname }}.csr dest: /tmp/{{ inventory_hostname }}.csr delegate_to: fake-nagios - name: Request certificate from CA server shell: | openssl ca -batch -config /etc/pki/tls/openssl.cnf -policy policy_anything -out /tmp/{{ inventory_hostname }}.crt -infiles /tmp/{{ inventory_hostname }}.csr delegate_to: fake-nagios **Human written playbook:** These tasks are pretty close to what my actual playbook looks like (specifically CA request task is almost exactly the same as 'Sign CSR, generate cert task': - name: Generate config file for CSR template: src: csr-config-template.j2 dest: "{{ host_csr_config }}" delegate_to: fake-nagios tags: - certs - CSR_config # CSR generated uses config from previous step # Outputs a CSR and a host key that was used to sign the CSR # (and validate the cert generated later) - name: Generate CSR become: true shell: | openssl req -new -newkey rsa:2048 \ ¦ -keyout {{ host_key_file }} \ ¦ -out {{ host_csr_file }} \ ¦ -nodes -config {{ host_csr_config }} delegate_to: fake-nagios tags: - certs - CSR # With unique_subject set in openssl.cnf, must revoke old certs # Should revoke old certs regardless so I'm OK with this constraint - name: Revoke existing NRPE certificate (if any) for {{ ansible_hostname }} become: true shell: | if grep -q "^V.*CN={{ ansible_hostname }}" {{ CA_root_dir }}/index.txt then ¦ openssl ca -revoke {{ CA_certs_dir }}/client_certs/{{ ansible_hostname }}_nrpe.pem \ ¦ -config /etc/pki/tls/openssl.cnf fi delegate_to: fake-nagios tags: - certs - cert_revoke # CA signs CSR, generates certificate file - name: Sign CSR, generate cert become: true shell: | openssl ca -batch -days 3650 -notext -md sha256 \ ¦ -keyfile {{ CA_certs_dir }}/ca/nrpe-ca_key.pem \ ¦ -cert {{ CA_certs_dir }}/ca/nrpe-ca_cert.pem \ ¦ -in {{ host_csr_file }} \ ¦ -out {{ host_cert_file }} delegate_to: fake-nagios register: nrpe_cert tags: - certs - make_cert