# Automatic password generation **URL:** \ **Category:** Ansible Project\ **Created:** [January 21, 2013, 4:06am UTC](https://forum.ansible.com/t/automatic-password-generation/12224 "2013-01-21T04:06:28Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Nolan\_Darilek](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@Nolan\_Darilek](https://forum.ansible.com/u/Nolan_Darilek)\ **Post date:** [January 21, 2013, 4:06am UTC](https://forum.ansible.com/t/automatic-password-generation/12224/1 "2013-01-21T04:06:28Z")
Spent most of yesterday diving into Ansible and encoding much of what I do as playbooks. I was wondering if anyone had a solution for this? Say you're installing WordPress or something. You want to set up a database likely just for WP, and a human won't interact with it at all. You could prompt for a password, but why when 99.999% of the access to this database will be the web app that created it? Instead of prompting for these sorts of single-use passwords, is there a function or other method to generate them randomly? Perhaps a way of setting variables to a random string of characters can be added, similar to that for prompting? Thanks. ---
**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\ **Post date:** [January 21, 2013, 9:04am UTC](https://forum.ansible.com/t/automatic-password-generation/12224/2 "2013-01-21T09:04:05Z")
Nolan Darilek wrote: > Say you're installing WordPress or something. You want to set up a > database likely just for WP, and a human won't interact with it at all. > You could prompt for a password, but why when 99.999% of the access to > this database will be the web app that created it? > > Instead of prompting for these sorts of single-use passwords, is there a > function or other method to generate them randomly? Perhaps a way of > setting variables to a random string of characters can be added, similar > to that for prompting? Maybe a local action to a shell script or piece of python which returns a password as a fact. Simplest example (untested):-   #!/bin/sh   # mkrandompassword - put this in the library directory   # alongside the playbook ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [January 21, 2013, 2:50pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/3 "2013-01-21T14:50:26Z")
I think it's generally useful to choose known passwords. You never know when you might need to rebuild that wordpress configuration file or fix something in a database. ---
**Author:** ![Nolan\_Darilek](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@Nolan\_Darilek](https://forum.ansible.com/u/Nolan_Darilek)\ **Post date:** [January 21, 2013, 3:02pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/4 "2013-01-21T15:02:43Z")
Well, you've got the configuration file, so no need to rebuild it. And that has the password. Either way though, thanks. I'll play with the fact-based method. ---
**Author:** ![Dag\_Wieers](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Dag\_Wieers](https://forum.ansible.com/u/Dag_Wieers)\ **Post date:** [February 18, 2013, 3:23pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/5 "2013-02-18T15:23:09Z")
Coming back to this (catching up on the mailing list), this is what I do in one of my test scripts to validate changes I made (in this case it was to test changes to the shell and debug module): ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [February 18, 2013, 3:36pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/6 "2013-02-18T15:36:08Z")
A somewhat crazy idea might be to write a lookup plugin like so: $GEN\_PASS(name\_of\_what\_the\_password\_is\_for) ex $GEN\_PASS('foo') probably should take some other parameters And if the file didn't exist, it would generate it and save it in the file (probably in ~/.ansible/somewhere) otherwise it would just return what was in the file. Crazy? ---
**Author:** ![jpmens1](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jpmens1](https://forum.ansible.com/u/jpmens1)\ **Post date:** [February 18, 2013, 3:41pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/7 "2013-02-18T15:41:35Z")
Use the new URI module to obtain a password from the (\*cough\*) cloud: [http://www.sethcardoza.com/tools/random-password-generator-api/](http://www.sethcardoza.com/tools/random-password-generator-api/) (\*groans\*) What could possibly go wrong ...         -JP ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [February 18, 2013, 3:45pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/8 "2013-02-18T15:45:33Z")
> Use the new URI module to obtain a password from the (\*cough\*) cloud: > > [http://www.sethcardoza.com/tools/random-password-generator-api/](http://www.sethcardoza.com/tools/random-password-generator-api/) > > (\*groans\*) > > What could possibly go wrong ... What if that was how I was going to implement it 🙂 \ ---
**Author:** ![Dag\_Wieers](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Dag\_Wieers](https://forum.ansible.com/u/Dag_Wieers)\ **Post date:** [February 18, 2013, 3:49pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/9 "2013-02-18T15:49:32Z")
How disappointing ! ---
**Author:** ![jpmens1](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jpmens1](https://forum.ansible.com/u/jpmens1)\ **Post date:** [February 18, 2013, 4:49pm UTC](https://forum.ansible.com/t/automatic-password-generation/12224/10 "2013-02-18T16:49:14Z")
> From you I was expecting a DNS-based solution, really. There, I fixed it for you: [http://jpmens.net/2011/12/01/lua-back-end-for-bind/](http://jpmens.net/2011/12/01/lua-back-end-for-bind/) 😉         -JP