# openstack os\_server\_facts: some of openstack\_servers entries partially replaced by asterisks **URL:** \ **Category:** Ansible Developer\ **Created:** [March 18, 2018, 10:25am UTC](https://forum.ansible.com/t/openstack-os-server-facts-some-of-openstack-servers-entries-partially-replaced-by-asterisks/27029 "2018-03-18T10:25:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![git.user](https://avatars.discourse-cdn.com/v4/letter/g/b2d939/32.png) [@git.user](https://forum.ansible.com/u/git.user)\ **Post date:** [March 18, 2018, 10:25am UTC](https://forum.ansible.com/t/openstack-os-server-facts-some-of-openstack-servers-entries-partially-replaced-by-asterisks/27029/1 "2018-03-18T10:25:09Z")
Hello. I just wrote a trivial snippet which uses ‘os\_server\_facts’ module to collect VM info. Snippet itself works fine but output a bit confusing me. It looks like this: “openstack\_servers”: [ { “HUMAN\_ID”: true, “NAME\_ATTR”: “name”, “OS-DCF:diskConfig”: “MANUAL”, “OS-EXT-AZ:availability\_zone”: “nova”, “OS-EXT-SRV-ATTR:host”: “node58.ostack.**", “OS-EXT-SRV-ATTR:hypervisor\_hostname”: "node58.ostack.**”, … “human\_id”: “test-instance-for-**", … “name”: "test-instance-for-**”, Real hypervisor’s name is node58.ostack.mydomain and vm test-instance-for-USER. And openstack authentication parameters looks like: domain: mydomain user: USER I mean every parts of openstack\_servers dict which corresponding to openstack auth-\>user\_domain\_name and/or project\_domain\_name and auth-\>username replaced by asterisks. As far as I can see data which os\_server\_facts module returns looks perfectly well so replacements come from ansible core. All this looks intentional, security related and idiotic at the same time. Is this a bug or I missing something in documentation? Could anyone give a hint where to dig further? ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [March 18, 2018, 10:41am UTC](https://forum.ansible.com/t/openstack-os-server-facts-some-of-openstack-servers-entries-partially-replaced-by-asterisks/27029/2 "2018-03-18T10:41:15Z")
Hi, > I just wrote a trivial snippet which uses 'os\_server\_facts' module to > collect VM info. > Snippet itself works fine but output a bit confusing me. > It looks like this: >     "openstack\_servers": [ >         { >             "HUMAN\_ID": true, >             "NAME\_ATTR": "name", >             "OS-DCF:diskConfig": "MANUAL", >             "OS-EXT-AZ:availability\_zone": "nova", >             "OS-EXT-SRV-ATTR:host": "node58.ostack.\*\*\*\*\*\*\*\*", >             "OS-EXT-SRV-ATTR:hypervisor\_hostname": > "node58.ostack.\*\*\*\*\*\*\*\*", ................. >              "human\_id": "test-instance-for-\*\*\*\*\*\*\*\*", > ................. >              "name": "test-instance-for-\*\*\*\*\*\*\*\*", > > Real hypervisor's name is node58.ostack.mydomain and vm > test-instance-for-USER. > And openstack authentication parameters looks like: > > domain: mydomain > user: USER > > I mean every parts of openstack\_servers dict which corresponding to > openstack auth-\>user\_domain\_name and/or project\_domain\_name and > auth-\>username replaced by asterisks. As far as I can see data which > os\_server\_facts module returns looks perfectly well so > replacements come from ansible core. > All this looks intentional, security related and idiotic at the same > time. Is this a bug or I missing something in documentation? Could > anyone give a hint where to dig further? the data censored out is probably contained in one of the options marked with no\_log=True. If one of them is a dict, ansible will censor everything in the output which appears as a value somewhere in that dict. For the openstack modules, that's everything in the auth and key options (see openstack\_full\_argument\_spec in module\_utils/openstack.py). Cheers, Felix ---
**Author:** ![git.user](https://avatars.discourse-cdn.com/v4/letter/g/b2d939/32.png) [@git.user](https://forum.ansible.com/u/git.user)\ **Post date:** [March 19, 2018, 6:17am UTC](https://forum.ansible.com/t/openstack-os-server-facts-some-of-openstack-servers-entries-partially-replaced-by-asterisks/27029/3 "2018-03-19T06:17:17Z")
You are right, thanks for advise. it’s here: /usr/lib/python3.5/site-packages/ansible/module\_utils/basic.py +452 def \_remove\_values\_conditions(value, no\_log\_strings, deferred\_removals): … for omit\_me in no\_log\_strings: native\_str\_value = native\_str\_value.replace(omit\_me, ‘\*’ \* 8) Hmm… it looks like a security issue ☹