ansible command on messages

Archives Ansible Project
1

Hi all.
With ansible we are changing root passwords on our machines. the root password is in a vault so all ok…
But I find our the the command we run to change the password is visible on /var/log/messages …included the password itself…
How can I remove that or do that in a different way?

Cheers

2

have you tried to do no_log: True ?

https://docs.ansible.com/ansible/2.5/reference_appendices/faq.html#how-do-i-keep-secret-data-in-my-playbook

3

Thanks heaps. there is also no_target_syslog… which it could be more appropriate for what I need to do.

Cheers

4

no_log
worked perfectly!

thanks

5

Hai please use this method I tested this and it successfully worked

First generate an encrypted password
Using

Python code for generating SHA512 password
python -c “from passlib.hash import sha512_crypt; import getpass; print
sha512_crypt.encrypt(getpass.getpass())”

And use

tasks:

  • name: changing root password
    user:
    name: “root” ## Should not have “-”
    password:
    “$6$rounds=656000$XCYDmKM2Wh6LkAkf$2t/9L0OP4yJgy3wukrahPAM1qZG.SFNoe3eR53
    EqTq1t6.X.9YL78PJ2uje6dAp1Xxt8UqDe.kqj2/9F7bsvM/”
6

I think vault its a better option and integrates better.