1

I am using ansible vault to encrypt the password, but when I am using debug mode it shows the password as plain text. Consider below code

Generate ansible-vault encrypted password

ansible-vault encrypt_string 'abc123' --name ansible_ssh_pass > inventory/group_vars/all.yml

test.yml

- name: Vault test
  hosts: group_1
  tasks:
    - name: Read Json
      set_fact:
         version_file: "{{ lookup('template','template/test.j2') | to_json }}"
      run_once: true

inventory/hosts

[group_1]
xxx.xxx.com ansible_host=xx.xx.xx.xx ansible_user=root
xxx.xxx.com ansible_host=xx.xx.xx.xx ansible_user=root

template/test.j2

{ "host" : "xxx.xxx.com",
  "username" : "root",
  "password" : "{{ hostvars[groups['group_1'][0]]['ansible_ssh_pass'] }}"  }

Playbook execution

ansible-playbook -i inventory/hosts test.yml --ask-vault-pass -vvv

Output

TASK [Read Json] ******************************************************************************************************************************************
task path: /test/test.yml:5
ok: [xxx.xxx.com] => {
    "ansible_facts": {
        "version_file": "\"{ \\\"host\\\" : \\\"xxx.xxx.com\\\",\\n  \\\"username\\\" : \\\"root\\\",\\n  \\\"password\\\" : \\\"abc123\\n\\\"  }\\n\""
    },
    "changed": false,
    "failed": false
}

Is there any way to avoid this?

va1bhav
  • 365
  • 1
  • 5
  • 21

2 Answers2

3

AFIK ansible vault encript passwords, although it can be visible if you use verbose options... For this you have to add to your playbook the option:

no_log: true

Take a look at this link as they say:

I don't believe Ansible keeps track of what came from the vault. To protect the data you can use no_log: true

Alvaro Niño
  • 547
  • 1
  • 4
  • 17
0

To protect the data you can use no_log: true

Joe Cove
  • 7
  • 3