# If the password and SSH key are crypted?

**URL:** <https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535>\
**Category:** AWX Project\
**Created:** [June 11, 2019, 4:35pm UTC](https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535 "2019-06-11T16:35:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohamedjarboui1995](https://avatars.discourse-cdn.com/v4/letter/m/a3d4f5/32.png) [@mohamedjarboui1995](https://forum.ansible.com/u/mohamedjarboui1995)\
**Post date:** [June 11, 2019, 4:35pm UTC](https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535/1 "2019-06-11T16:35:11Z")

</div>

Hello,

For a security raison of some sensitive data, i ask you if the password of the user and the SSH key are crypted or not? Thanks,

Cordially,

Mohamed Amine JARBOUI  
Devops Intern

---

<div class="post-metadata">

**Author:** ![RC1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@RC1](https://forum.ansible.com/u/RC1)\
**Post date:** [June 12, 2019, 6:54am UTC](https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535/2 "2019-06-12T06:54:09Z")

</div>

Password of user and SSH keys are encrypted.

Data is encrypted before it is saved to the database and is decrypted when required. The encryption/decryption process derives the AES-256 bit encryption key from \<SECRET\_KEY, field\_name, primary\_key\> where field\_name is the name of the Model field and primary\_key is the database assigned auto-incremented record ID. Thus, if any attribute used in the key generation process changes, Tower fails to correctly decrypt the secret

You can verify it by following steps:

1. Go to the postgres container

#docker exec –it postgres /bin/bash

2. Login to AWX user:

# psql –U awx

3. List the databse that exist:

#\list

4. Connect to awx database:

#\c awx

5. List all table in database:

#\d

6. Fetch details of specific table as per your wish(In this case user password is saved in auth\_user table)

#SELECT \* FROM auth\_user;

Best regards.

---

<div class="post-metadata">

**Author:** ![Harrison\_Katz](https://avatars.discourse-cdn.com/v4/letter/h/f04885/32.png) [@Harrison\_Katz](https://forum.ansible.com/u/Harrison_Katz)\
**Post date:** [January 27, 2021, 8:13pm UTC](https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535/3 "2021-01-27T20:13:09Z")

</div>

How can we rotate the secret\_key? Is this possible? Perhaps with awx-manage or other commands executed directly on the DB?

---

<div class="post-metadata">

**Author:** ![rpetrell](https://avatars.discourse-cdn.com/v4/letter/r/b4bc9f/32.png) [@rpetrell](https://forum.ansible.com/u/rpetrell)\
**Post date:** [January 27, 2021, 9:47pm UTC](https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535/4 "2021-01-27T21:47:14Z")

</div>

Hey Harrison,

There’s a command for doing this, awx-manage regenerate\_secret\_key

[https://github.com/ansible/awx/blob/devel/awx/main/management/commands/regenerate\_secret\_key.py](https://github.com/ansible/awx/blob/devel/awx/main/management/commands/regenerate_secret_key.py)

Running this command generates a new key and decrypts/re-encrypts all the secrets in the database. When it’s finished, the new key is printed and must be updated:

[https://github.com/ansible/awx/blob/devel/installer/inventory#L116](https://github.com/ansible/awx/blob/devel/installer/inventory#L116)

The k8s installer that can handle much of this for you:

[https://github.com/ansible/awx/blob/abc6a842105999bfaadf312ed1fb9596574355bf/installer/roles/kubernetes/tasks/rekey.yml](https://github.com/ansible/awx/blob/abc6a842105999bfaadf312ed1fb9596574355bf/installer/roles/kubernetes/tasks/rekey.yml)

I highly recommend backing up this key (and a dump of your database) before and after just so no mistakes are made.

---

<div class="post-metadata">

**Author:** ![Harrison\_Katz](https://avatars.discourse-cdn.com/v4/letter/h/f04885/32.png) [@Harrison\_Katz](https://forum.ansible.com/u/Harrison_Katz)\
**Post date:** [January 27, 2021, 10:06pm UTC](https://forum.ansible.com/t/if-the-password-and-ssh-key-are-crypted/30535/5 "2021-01-27T22:06:51Z")

</div>

Wonderful! Thanks!