Automatic password generation

Spent most of yesterday diving into Ansible and encoding much of what I do as playbooks. I was wondering if anyone had a solution for this?

Say you're installing WordPress or something. You want to set up a database likely just for WP, and a human won't interact with it at all. You could prompt for a password, but why when 99.999% of the access to this database will be the web app that created it?

Instead of prompting for these sorts of single-use passwords, is there a function or other method to generate them randomly? Perhaps a way of setting variables to a random string of characters can be added, similar to that for prompting?

Thanks.

Nolan Darilek wrote:

Say you're installing WordPress or something. You want to set up a
database likely just for WP, and a human won't interact with it at all.
You could prompt for a password, but why when 99.999% of the access to
this database will be the web app that created it?

Instead of prompting for these sorts of single-use passwords, is there a
function or other method to generate them randomly? Perhaps a way of
setting variables to a random string of characters can be added, similar
to that for prompting?

Maybe a local action to a shell script or piece of python which returns a password as a fact. Simplest example (untested):-

  #!/bin/sh
  # mkrandompassword - put this in the library directory
  # alongside the playbook

I think it's generally useful to choose known passwords.

You never know when you might need to rebuild that wordpress
configuration file or fix something in a database.

Well, you've got the configuration file, so no need to rebuild it. And that has the password.

Either way though, thanks. I'll play with the fact-based method.

Coming back to this (catching up on the mailing list), this is what I do in one of my test scripts to validate changes I made (in this case it was to test changes to the shell and debug module):

A somewhat crazy idea might be to write a lookup plugin like so:

$GEN_PASS(name_of_what_the_password_is_for)

ex

$GEN_PASS('foo')

probably should take some other parameters

And if the file didn't exist, it would generate it and save it in the
file (probably in ~/.ansible/somewhere)

otherwise it would just return what was in the file.

Crazy?

Use the new URI module to obtain a password from the (*cough*) cloud:

http://www.sethcardoza.com/tools/random-password-generator-api/

(*groans*)

What could possibly go wrong ...

        -JP

Use the new URI module to obtain a password from the (*cough*) cloud:

http://www.sethcardoza.com/tools/random-password-generator-api/

(*groans*)

What could possibly go wrong ...

What if that was how I was going to implement it :slight_smile:

</kidding>

How disappointing !

From you I was expecting a DNS-based solution, really.

There, I fixed it for you: http://jpmens.net/2011/12/01/lua-back-end-for-bind/

:wink:

        -JP