# Opportunity to use signed playbook. **URL:** \ **Category:** Ansible Project\ **Created:** [June 7, 2021, 9:48am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295 "2021-06-07T09:48:39Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Elkmar](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@Elkmar](https://forum.ansible.com/u/Elkmar)\ **Post date:** [June 7, 2021, 9:48am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295/1 "2021-06-07T09:48:39Z")
Hi all. I need to check a playbook authenticity before execution. Is it possible? If yes how can I sign a playbook and check it in ansible before execution (and also prohibit any execution of non signed playbooks)? Sorry, if this question has been already discussed, but I have not found information. Best regards. ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [June 7, 2021, 10:44am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295/2 "2021-06-07T10:44:23Z")
> ... check a playbook authenticity before execution For example > cat test-003.yml - hosts: all   gather\_facts: false   vars:     my\_filename: test-003.yml     my\_path: "{{ playbook\_dir }}/{{ my\_filename }}"     my\_hash\_path: "{{ my\_path }}.sha1"     my\_hash: "{{ (lookup('file', my\_hash\_path).split()).0 }}"   tasks:     - name: Test integrity of the playbook       block:         - stat:             path: "{{ my\_path }}"             checksum\_algorithm: sha1           register: result         - assert:             that: result.stat.checksum == my\_hash       delegate\_to: localhost       run\_once: true > sha1sum test-003.yml \> test-003.yml.sha1 > cat test-003.yml.sha1 9762fde5aa52f72dfcf064fa3062fd41540573af test-003.yml > ansible-playbook test-003.yml PLAY [all] ---
**Author:** ![Antony\_Stone](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Antony\_Stone](https://forum.ansible.com/u/Antony_Stone)\ **Post date:** [June 7, 2021, 10:48am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295/3 "2021-06-07T10:48:57Z")
> \> cat test-003.yml > - hosts: all >   gather\_facts: false >   vars: >     my\_filename: test-003.yml >     my\_path: "{{ playbook\_dir }}/{{ my\_filename }}" >     my\_hash\_path: "{{ my\_path }}.sha1" >     my\_hash: "{{ (lookup('file', my\_hash\_path).split()).0 }}" >   tasks: >     - name: Test integrity of the playbook >       block: >         - stat: >             path: "{{ my\_path }}" >             checksum\_algorithm: sha1 >           register: result >         - assert: >             that: result.stat.checksum == my\_hash >       delegate\_to: localhost >       run\_once: true That's a good enough way of checking that the hash of the playbook in question does match the stored hash, but... > \> sha1sum test-003.yml \> test-003.yml.sha1 > \> cat test-003.yml.sha1 > 9762fde5aa52f72dfcf064fa3062fd41540573af test-003.yml ...means that it's trivial for someone to take a playbook, modify it, and create a new hash file. I interpret "signed" in the original question to mean something that cannot be falsified by someone who is running the ansible commands. Antony. ---
**Author:** ![Elkmar](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@Elkmar](https://forum.ansible.com/u/Elkmar)\ **Post date:** [June 7, 2021, 11:32am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295/4 "2021-06-07T11:32:45Z")
Yep, Antony right. The idea is as follows: we have fileA and fileB. FileA is “signed” by me (for example has digital signature) and we can start it with ansible-playbook command. FileB doesn’t have signature so it can’t do any changes on remote hosts. Is it possible? понедельник, 7 июня 2021 г. в 13:49:28 UTC+3, Antony Stone: ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [June 7, 2021, 11:37am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295/5 "2021-06-07T11:37:36Z")
Locally, you might want to set the ownership and the permissions as appropriate. Use get\_url if the signatures are stored remotely [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get\_url\_module.html](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html) ---
**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\ **Post date:** [June 7, 2021, 11:42am UTC](https://forum.ansible.com/t/opportunity-to-use-signed-playbook/35295/6 "2021-06-07T11:42:05Z")
> Yep, Antony right. > The idea is as follows: we have fileA and fileB. FileA is "signed" by me (for example has digital signature) and we can start it with ansible-playbook command. FileB doesn't have signature so it can't do any changes on remote hosts. Is it possible? I doubt that verifying the signature is a solution for preventing tampering ... the user simply can ssh to the machine for example. Regards            Racke