# Best way to manage hosts with Ansible (secutiry)

**URL:** <https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966>\
**Category:** Ansible Project\
**Created:** [March 23, 2016, 12:11pm UTC](https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966 "2016-03-23T12:11:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vamberto\_Junior](https://avatars.discourse-cdn.com/v4/letter/v/dfb087/32.png) [@Vamberto\_Junior](https://forum.ansible.com/u/Vamberto_Junior)\
**Post date:** [March 23, 2016, 12:11pm UTC](https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966/1 "2016-03-23T12:11:59Z")

</div>

Hellow everybody

I am a new user in Ansible’s World so in my studies, I have some doubts about the best way to manage hosts with Ansible.

My question is… What is the best securty way to manage hosts with Ansible ?

Some docs tell to use ssh without pass from the server Ansible to host and use sudo without pass too (ansible ALL=NOPASSWD: ALL)

So in your opinion what is the best way ?

---

<div class="post-metadata">

**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\
**Post date:** [March 23, 2016, 1:35pm UTC](https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966/2 "2016-03-23T13:35:40Z")

</div>

Looks like you’ve got 2 different questions there, 1) what’s most secure way, and 2) what’s the “best” way.

NOPASSWD:ALL is certainly the most convenient way, but it probably isn’t the most secure. (You would need to ensure that the SSH private key is well secured, and probably only allowed to be used from a hardened bastion host (look at “man ssh\_config” and the “from=” parameter – possibly also using a “command=” wrapper to check that arbitrary commands (as opposed to sftp and ansible-driven python and sudo invocations) are not accepted).

If you don’t want to do that, you can have Ansible prompt for the su or sudo password (check out the --ask-pass and --ask-become options). That is a little more secure, although it’s quite a lot more “hassle”, unless you have a dynamic inventory source that can set the required ansible\_ssh\_user/ansible\_ssh\_pass/ansible\_become\_method/ansible\_become\_pass connection variables acquired from some “other source”.

---

<div class="post-metadata">

**Author:** ![Vamberto\_Junior](https://avatars.discourse-cdn.com/v4/letter/v/dfb087/32.png) [@Vamberto\_Junior](https://forum.ansible.com/u/Vamberto_Junior)\
**Post date:** [March 23, 2016, 2:07pm UTC](https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966/3 "2016-03-23T14:07:02Z")

</div>

Thanks for your help Uditha Desilva  
🙂

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [March 27, 2016, 7:18pm UTC](https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966/4 "2016-03-27T19:18:57Z")

</div>

I am by far not an expert on ansible security. But after reading lots  
and lots of docs I went for the following:

- Use SSH keys with passphrase  
- Store passphrase in ssh-agent if needed, and delete them afterwards  
- Do \*not\* allow the ansible\_user passwordless sudo  
- Provide the sudo password (ansible\_become\_pass) in a host\_vars file  
(host\_vars/xyz for host xyz)  
- Encrypt that host\_vars file with ansible vault  
- Store the ansible-vault passphase in a file on my machine

I also do not use the same username on each host, but also store that  
in the host\_vars file.  
I also do not use the same ssh port on each machine, you guess it:  
stored in a host\_vars file (although this is security by obscurity, it  
keeps the logs clean, i.e. script kiddies do not fill the logs with  
stupid attempts)

Just my 2 cents, YMMV.

Johannes

---

<div class="post-metadata">

**Author:** ![Vamberto\_Junior](https://avatars.discourse-cdn.com/v4/letter/v/dfb087/32.png) [@Vamberto\_Junior](https://forum.ansible.com/u/Vamberto_Junior)\
**Post date:** [March 27, 2016, 9:16pm UTC](https://forum.ansible.com/t/best-way-to-manage-hosts-with-ansible-secutiry/20966/5 "2016-03-27T21:16:42Z")

</div>

Thanks Johannes Kastl for the help 🙂