I'm trying to run a Ansible playbook from cron (hence no interaction possible) on a group of servers with sudo. Several tutorials and posts throughout the internet recommend to set the sudo password in plaintext, or set up an Ansible-Vault (which also requites an ansible-valt password file in plaintext somewhere, so no deal). Some recommend to set NOPASSWD on sudoers file to the user running the sudo commands, which I also cannot do. All those solutions present security concerns.

So I was wondering if there's a way around it? Maybe encrypt the plaintext password in a way that Ansible can decrypt and read it?

Thanks in advance!

  • 2
    Who are you trying to protect the password from? Why can't you use NOPASSWD (on specific commands)? – muru May 30 '19 at 6:11
  • Unfortunately we have in our corporation a heavy hardening policy that dictates that no linux user whatsoever can have the NOPASSWD attribute in the sudoers file, under any circustances. – Vinicius Freitas May 30 '19 at 13:41
  • That answers the second question, but not the first. – muru May 31 '19 at 2:34
  • Ow, sorry. The same policies also state that no plaintext password can exist recorded in any file. – Vinicius Freitas May 31 '19 at 13:37
  • So you are asking for something impossible. No plaintext passwords can be stored, so you are asking if you can use an encrypted password instead. But to decrypt anything encrypted, you need a pass(word|phrase), which, according to your policy cannot be stored in plain text. Or in other words, you are asking for a set of credentials that can be used to run ansible from cron, but can't be used if they were leaked to something/someone else. I wish I had a password like that. – AlexKing Nov 2 '19 at 8:54

Ansible will accept if the password is in hashed form. I created a hashed password using python

python -c 'import crypt; print crypt.crypt("password", "$6$random_salt")'
python3 -c 'import crypt; print(crypt.crypt("password", crypt.mksalt(crypt.METHOD_SHA512)))'

replace the password with your password then you can paste the output of the command above to your Ansible task.

- name: name
  become: true
    password: hashed password
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.