# State of the Art for Unattended Ansible? **URL:** \ **Category:** Get Help\ **Created:** [May 21, 2025, 11:22pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897 "2025-05-21T23:22:32Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Dylan\_Martin3](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dylan_martin3/32/8574_2.png) [@Dylan\_Martin3](https://forum.ansible.com/u/Dylan_Martin3)\ **Post date:** [May 21, 2025, 11:22pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/1 "2025-05-21T23:22:32Z")
Hi folks. I want to run Ansible unattended via cron on a utility server in a datacenter. It’s been a while since I’ve set one up and I was wondering if the best practices have changed. My initial thought is to set up a user on all the remote boxes with sudo nopassword + a passwordless ssh key that my cron job on the utility box can use. That’s a little scary, but nothing else I can think of is any less scary. I could have the ssh key live in a running ssh-agent on the utility box and have to unlock it each time the utility box reboots, but that adds the risk of not unlocking it at a crucial time. Ansible-pull seems less scary, but the vulnerability is basically the same: If someone gets write access to the repo, they can do anything. I guess, I’m building a thing that controls all the things, so scary is part of the deal. Anyway, what I really want to know is, have there been any changes in how this gets approached in the last 10 years? Thanks! ---
**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\ **Post date:** [May 22, 2025, 11:35am UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/2 "2025-05-22T11:35:27Z")
If you’re open to running a webUI like [AWX](https://github.com/ansible/awx), you can get all of the access control features and credential management while having built-in schedules. Ansible also has the ability (with `become`) to do passworded `sudo` instead of needing passwordless access on remote boxes. ---
**Author:** ![markuman](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@markuman](https://forum.ansible.com/u/markuman)\ **Post date:** [May 23, 2025, 10:16am UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/3 "2025-05-23T10:16:31Z")
> [@Dylan\_Martin3](#): > > Ansible-pull seems less scary, but the vulnerability is basically the same: If someone gets write access to the repo, they can do anything. We use ansible-pull in our cloudinit. So every new server gets initialized. Use git tags, protected branches and merge request reviews …100% security is not reachable. ---
**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\ **Post date:** [May 23, 2025, 1:34pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/4 "2025-05-23T13:34:33Z")
I would add a lot of asterisks next to using AWX right now, with peace and love. See the top part of the README here [GitHub - ansible/awx: AWX provides a web-based user interface, REST API, and task engine built on top of Ansible. It is one of the upstream projects for Red Hat Ansible Automation Platform.](https://github.com/ansible/awx) Might be more prudent to buy in to AWX when they’ve settled on how the new architecture is going to look. I don’t know if there’s a timeline for when that may be. It may have been discussed at RedHat summit, but I did not attend. ---
**Author:** ![bostonlinux](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bostonlinux/32/7466_2.png) [@bostonlinux](https://forum.ansible.com/u/bostonlinux)\ **Post date:** [May 23, 2025, 5:34pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/5 "2025-05-23T17:34:08Z")
I did attend the RH Summit and spoke with some folks on the Ansible team about AWX. From what I gather they are still working on some of the repos that are going to be required to run AWX. Even after all the repos are completed, deploying AWX will require considerable work to put all the repos together to deploy AWX with the new architecture. In addition, if a CVE is released we will need to recompile the repos to redeploy AWX. ---
**Author:** ![Dylan\_Martin3](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dylan_martin3/32/8574_2.png) [@Dylan\_Martin3](https://forum.ansible.com/u/Dylan_Martin3)\ **Post date:** [May 29, 2025, 6:34pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/6 "2025-05-29T18:34:08Z")
How does that work in an unattended situation? ---
**Author:** ![Dylan\_Martin3](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dylan_martin3/32/8574_2.png) [@Dylan\_Martin3](https://forum.ansible.com/u/Dylan_Martin3)\ **Post date:** [May 29, 2025, 6:37pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/7 "2025-05-29T18:37:31Z")
Oh, I’m an idiot. If we require signed commits ansible pull is much much more secure. ---
**Author:** ![markfaine](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/markfaine/32/7291_2.png) [@markfaine](https://forum.ansible.com/u/markfaine)\ **Post date:** [June 2, 2025, 2:26pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/8 "2025-06-02T14:26:57Z")
You could use a ci/cd job to run it and set the become password as a secret. ---
**Author:** ![Dylan\_Martin3](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dylan_martin3/32/8574_2.png) [@Dylan\_Martin3](https://forum.ansible.com/u/Dylan_Martin3)\ **Post date:** [June 2, 2025, 4:30pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/9 "2025-06-02T16:30:41Z")
Yeah, that’s what I’m talking about! ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [July 2, 2025, 4:30pm UTC](https://forum.ansible.com/t/state-of-the-art-for-unattended-ansible/42897/10 "2025-07-02T16:30:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.