Ansible Security with cronjobs - passwordless sudo or not?

Get Help
1

So I am trying to set up an ansible managed environment with as much security as possible.
One requirement is that I need to execute ansible via cron or systemd timer, so prompting for credentials is not possible.
Access to the client is via passphrase protected ssh key, passphrase stored in ssh agent, managed by keychain. So I need to pass the passphrase once per boot. That is ok.

Option A:
Allow passwordless sudo for the ansible user on the clients, which makes things easy.

Option B:
Require a sudo password and store it in the inventory, vault protected of course. Then for automated execution, I need a solution for the vault password. Since I do not have a thing like hashicorp vault, all I am left with (I think) is to store it in a file on disk.

I have a hard time assessing the security of both options, because they both have pros and cons.

Option A:
pro:

  • No credentials stored on disk anywhere

con:

  • local ansible user has complete system access, once compromised. Unsure how realistic this is, as the only way in to the user is via passphrase protected ssh key.

Option B:
pro:

  • local ansible user cannot do harm without password

con:

  • vault password stored on disk on controller.

Am I missing anything? How do I weight these factors? Any opinions or alternative ways?

2

If the remote host is compromised (someone gets access to the ansible account on that host)

  • For option A, they get full access to that host.
  • For option B, they get limited access.

If the controller is compromised (someone gets access to any account on the controller)

  • For option A, they get full access to all hosts
  • For option B, they might get full access to all hosts, if they have permission to read the vault password file

It seems like B is a bit safer. But locking down the controller is key.

Introducing something like Hashicorp Vault doesnt really impact the decision, as far as I know, if you are only dealing with one controller (I mean, it is nice to have and reduces some work). Once you have multiple hosts trying to use the same secret, then it becomes more valuable. But I am not a security engineer :slight_smile: