# How to mask connection string Passwords while connecting through DB using sqlplus ansible **URL:** \ **Category:** Ansible Project\ **Created:** [April 29, 2019, 11:04pm UTC](https://forum.ansible.com/t/how-to-mask-connection-string-passwords-while-connecting-through-db-using-sqlplus-ansible/30217 "2019-04-29T23:04:37Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Raj5](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Raj5](https://forum.ansible.com/u/Raj5)\ **Post date:** [April 29, 2019, 11:04pm UTC](https://forum.ansible.com/t/how-to-mask-connection-string-passwords-while-connecting-through-db-using-sqlplus-ansible/30217/1 "2019-04-29T23:04:37Z")
I am running into an issue where ansible is spitting up password, which is a security breach as these logs will automatically uploads to developer shared location for review. How can I mask the passwords in spitting up here. I need to use stdout\_lines whether we run the job in clean state or not, so I cant take out that from list. ` - name: Disabling Queue shell: source ~/.bash\_profile && sqlplus -S ‘{{ admin }}/{{ password }}@{{ TNS\_NAME }}’ @“disable.sql” register: disable\_queue delegate\_to: localhost args: chdir: roles/db-deploy/files/ tags: Jobs - debug: var=disable\_jobqueue.stdout\_lines delegate\_to: localhost tags:Jobs ` `TASK [db-deploy : Disabling Job Queue] ******************** 21:46:20 [buildNode1] fatal: [Host1 -> localhost]: FAILED! => {"changed": true, "cmd": "source ~/.bash_profile && sqlplus -S 'userName/visiblePassword(DESCRIPTION = (CONNECT_TIMEOUT=5)(RETRY_COUNT=0)(LOAD_BALANCE = off)(FAILOVER = on)(ADDRESS_LIST=(ADDRESS = (PROTOCOL = TCP)(HOST = Host1)(PORT = 1521))(ADDRESS = (PROTOCOL = TCP)(HOST = Host1)(PORT = 1521)))(CONNECT_DATA = (SERVICE_NAME = serviceName1)))' @\"disable.sql\"", "delta": "0:00:00.412873", "end": "2019-04-25 02:46:20.036544", "msg": "non-zero return code", "rc": 127, "start": "2019-04-25 02:46:19.623671", "stderr": "/bin/sh: sqlplus: command not found", "stderr_lines": ["/bin/sh: sqlplus: command not found"], "stdout": "", "stdout_lines": []} 21:46:20 [buildNode1] fatal: [Host2 -> localhost]: FAILED! => {"changed": true, "cmd": "source ~/.bash_profile && sqlplus -S 'userName/visiblePassword(DESCRIPTION = (CONNECT_TIMEOUT=5)(RETRY_COUNT=0)(LOAD_BALANCE = off)(FAILOVER = on)(ADDRESS_LIST= (ADDRESS = (PROTOCOL = TCP)(HOST = Host2)(PORT = 1521))(ADDRESS = (PROTOCOL = TCP)(HOST = Host2)(PORT = 1521)))(CONNECT_DATA = (SERVICE_NAME = serviceName2)))' @\"disable.sql\"", "delta": "0:00:00.419597", "end": "2019-04-25 02:46:20.041097", "msg": "non-zero return code", "rc": 127, "start": "2019-04-25 02:46:19.621500", "stderr": "/bin/sh: sqlplus: command not found", "stderr_lines": ["/bin/sh: sqlplus: command not found"], "stdout": "", "stdout_lines": []} 21:46:20 [buildNode1] fatal: [Host3 -> localhost]: FAILED! => {"changed": true, "cmd": "source ~/.bash_profile && sqlplus -S 'userName/visiblePassword(DESCRIPTION = (CONNECT_TIMEOUT=5)(RETRY_COUNT=0)(LOAD_BALANCE = off)(FAILOVER = on)(ADDRESS_LIST=(ADDRESS = (PROTOCOL = TCP)(HOST = Host3)(PORT = 1521))(ADDRESS = (PROTOCOL = TCP)(HOST = Host3)(PORT = 1521)))(CONNECT_DATA = (SERVICE_NAME = serviceName3)))' @\"disable.sql\"", "delta": "0:00:00.419941", "end": "2019-04-25 02:46:20.054755", "msg": "non-zero return code", "rc": 127, "start": "2019-04-25 02:46:19.634814", "stderr": "/bin/sh: sqlplus: command not found", "stderr_lines": ["/bin/sh: sqlplus: command not found"], "stdout": "", "stdout_lines": []}` Thanks and Regards Raj ---
**Author:** ![Sathya\_Narayanan](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Sathya\_Narayanan](https://forum.ansible.com/u/Sathya_Narayanan)\ **Post date:** [April 30, 2019, 4:52am UTC](https://forum.ansible.com/t/how-to-mask-connection-string-passwords-while-connecting-through-db-using-sqlplus-ansible/30217/2 "2019-04-30T04:52:44Z")
Have you tried using vault ? ---
**Author:** ![Raj5](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Raj5](https://forum.ansible.com/u/Raj5)\ **Post date:** [April 30, 2019, 5:26am UTC](https://forum.ansible.com/t/how-to-mask-connection-string-passwords-while-connecting-through-db-using-sqlplus-ansible/30217/3 "2019-04-30T05:26:32Z")
Yes, admin & password variables will replace here and those are encrypted using ansible vault ---
**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\ **Post date:** [April 30, 2019, 5:41am UTC](https://forum.ansible.com/t/how-to-mask-connection-string-passwords-while-connecting-through-db-using-sqlplus-ansible/30217/4 "2019-04-30T05:41:58Z")
> I am running into an issue where ansible is spitting up password, which is a security breach as these logs will > automatically uploads to developer shared location for review. How can I mask the passwords in spitting up here. I need > to use stdout\_lines whether we run the job in clean state or not, so I cant take out that from list. > > \> > -name:DisablingQueue > shell:source ~/.bash\_profile && sqlplus -S '{{ admin }}/{{password }}@{{TNS\_NAME }}' @"disable.sql" > register: disable\_queue > delegate\_to: localhost > args: > chdir: roles/db-deploy/files/ > tags: Jobs > > - debug: var=disable\_jobqueue.stdout\_lines > delegate\_to: localhost > tags:Jobs > \> Hello Raj, you can disable logging of the task details with no\_log: True Also you can pass the password in an environment variable and use that in the shell command. Regards         Racke ---
**Author:** ![Adam\_E](https://avatars.discourse-cdn.com/v4/letter/a/c68b51/32.png) [@Adam\_E](https://forum.ansible.com/u/Adam_E)\ **Post date:** [April 30, 2019, 5:31pm UTC](https://forum.ansible.com/t/how-to-mask-connection-string-passwords-while-connecting-through-db-using-sqlplus-ansible/30217/5 "2019-04-30T17:31:51Z")
you could also look at using oracle wallet if you don’t want to use environment variables for some reason. [https://docs.oracle.com/cd/B19306\_01/network.102/b14266/cnctslsh.htm#g1033548](https://docs.oracle.com/cd/B19306_01/network.102/b14266/cnctslsh.htm#g1033548)