# Prevent sensitive data from leaking to syslog when using e.g. the command module

**URL:** <https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422>\
**Category:** Ansible Project\
**Created:** [September 5, 2013, 2:58pm UTC](https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422 "2013-09-05T14:58:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_Petrov](https://avatars.discourse-cdn.com/v4/letter/p/f475e1/32.png) [@Peter\_Petrov](https://forum.ansible.com/u/Peter_Petrov)\
**Post date:** [September 5, 2013, 2:58pm UTC](https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422/1 "2013-09-05T14:58:14Z")

</div>

Let’s say I have the following task:

> - name: mongodb | Setup mongodb admin user  
> tags: mongodb  
> command: /usr/bin/mongo -u admin --eval “db.getSiblingDB(‘admin’).addUser(‘admin’, ‘{{pass\_admin}}’)” admin  
> changed\_when: false  
> ignore\_errors: yes

All is fine with this, except one thing - my precious top-secret password gets written in /var/log/syslog by ansible-command, where it becomes visible to non-privileged users.

Is there any way to selectively prevent a task from logging this? I found the no\_log parameter which specific modules can use to prevent some arguments from being logged, but it doesn’t seem usable by an end user.

Thanks!

P.S. The reason I’m not using the mongodb\_user module is that it doesn’t work on Mongo 2.2. or lower, and I’m stuck with 2.0 for the moment. The syntax for addUser() is different in 2.4, and mongodb\_user only supports that.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [September 5, 2013, 6:50pm UTC](https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422/2 "2013-09-05T18:50:24Z")

</div>

So we have a mongo user module (see online module docs)

Using this, Ansible is smart enough to not log parameters named ‘password’ or ‘login\_password’.

There is also a “no\_log=yes” parameter you can use generically speaking on any module.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [September 5, 2013, 6:51pm UTC](https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422/3 "2013-09-05T18:51:04Z")

</div>

I read the rest of your post, how about fixing the mongodb module so it can detect the version and act appropriately?

---

<div class="post-metadata">

**Author:** ![Peter\_Petrov](https://avatars.discourse-cdn.com/v4/letter/p/f475e1/32.png) [@Peter\_Petrov](https://forum.ansible.com/u/Peter_Petrov)\
**Post date:** [September 6, 2013, 1:40am UTC](https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422/4 "2013-09-06T01:40:11Z")

</div>

> There is also a “no\_log=yes” parameter you can use generically speaking on any module.

How do I use that as an end user (not as a module author)? Passing “no\_log=yes” at the “command:” line assumes that it is part of the command I want to execute. Putting “no\_log: yes” as a separate line results in the following:

ERROR: no\_log is not a legal parameter in an Ansible task or handler

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [September 6, 2013, 12:30pm UTC](https://forum.ansible.com/t/prevent-sensitive-data-from-leaking-to-syslog-when-using-e-g-the-command-module/13422/5 "2013-09-06T12:30:26Z")

</div>

Right, it’s an internalism.