# sensitive data - via lookup or file separation does not work as expected

**URL:** <https://forum.ansible.com/t/sensitive-data-via-lookup-or-file-separation-does-not-work-as-expected/12313>\
**Category:** Ansible Project\
**Tags:** ansible-project\
**Created:** [February 8, 2013, 1:31pm UTC](https://forum.ansible.com/t/sensitive-data-via-lookup-or-file-separation-does-not-work-as-expected/12313 "2013-02-08T13:31:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [February 8, 2013, 1:31pm UTC](https://forum.ansible.com/t/sensitive-data-via-lookup-or-file-separation-does-not-work-as-expected/12313/1 "2013-02-08T13:31:25Z")

</div>

> Hi all,  
> I need some advice on how to include sensitive data into config files. We  
> are using cfengine2 and bcfg2 (and are testing salt and ansible at the  
> moment as -possible- replacement for cf/bcfg) and for both tools we have  
> recipes to include e.g. password files into not-so-secret files (on the  
> client). In ansible I tried the same with this simple example:

Yeah, it's a crowded space 🙂

bcfg2/Argon guys are decent folks, hung out some with one of them at  
USENIX. If you are looking at the last one be VERY sure you are  
comfortable with the crypto layer.  
I think it's on the wrong path for numerous reasons but do not really  
want to turn my list into a list for discussing other config tools.

Ansible is different in lots of ways from all of these -- focused on  
/real/ orchestration, very strong for multi-tier app deployment (but  
also OS config obviously), no agents, no server, no required database,  
no additional ports, extensible in any language, and it's \*actually\*  
data driven and parseable (not only is there no DSL, conditionals  
aren't just templates). Etc.

> ansible\_hosts:  
> ---  
> [testhosts]  
> test ansible\_ssh\_host=127.0.0.1
> 
> playbook:  
> ---  
> - hosts: testhosts  
> &nbsp;&nbsp;user: root
> 
> &nbsp;&nbsp;vars\_files:  
> &nbsp;&nbsp;&nbsp;&nbsp;- /tmp/pwd0  
> &nbsp;&nbsp;vars:  
> &nbsp;&nbsp;&nbsp;&nbsp;mypwd: $FILE(/tmp/pwd1)  
> &nbsp;&nbsp;tasks:  
> &nbsp;&nbsp;&nbsp;&nbsp;- name: include sensitive data  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;template: src=sensitive.conf.j2 dest=/tmp/sensitive.conf owner=root  
> group=root mode=0400
> 
> template:  
> ---  
> from pwd0: {{ moresecret.pwd }}  
> from vars\_files/pwd1: {{ mypwd[0] }}

> and the data pwd0 (root.root/0640):  
> ---  
> moresecret: {pwd: 'blablub', otherkey: 'something'}
> 
> and pwd1 (root.root/0640):  
> ---  
> tralala
> 
> Now playing this book on the local host (with sudo) leads to:
> 
> ansible-playbook -i ~/WORKING/ansible/.ansible\_hosts -c local -l test -s -K  
> ~/WORKING/ansible/nae/test/testpwd.yml -v  
> sudo password:  
> ERROR: file not found: /tmp/pwd0

Templates are evaluated \*completely\* on the management machine side,  
so the file you have referenced in /tmp is never exposed to the remote  
side.

Sudo happens \*only\* on the remote side too. So the user you are  
running ansible as \*must\* have access to read that file. This is by  
design and is actually  
more secure that way. You don't need a server running as root, etc.

Assuming what you want is to not keep passwords in git, or have a git  
repo which is configured more strictly, is to reference a vars\_files  
file that is outside of your git repository, such as

vars\_files:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/opt/secret/passwords.yml

etc

This is pretty much borrowed from Puppet strategy. Of course you can  
use $FILE(/whatever/path) as well too, though you may also want to  
keep other settings outside of version control.

Hope that helps and is more of what you are looking for!