301 reputation
410
bio website supervacuo.com
location United Kingdom
age
visits member for 4 years, 6 months
seen Jan 26 at 13:45

Jan
26
awarded  Good Question
Jan
25
comment How can I implement ansible with per-host passwords, securely?
@Jepper I use SSH keys to connect to servers as an unprivileged user and then want to sudo to run specific ansible modules which require it. It sounds like you're sticking to modules which don't, or you're SSHing as root -- neither of which seems ideal. Thanks, though!
Dec
24
awarded  Critic
Sep
10
awarded  Notable Question
Jun
15
awarded  Popular Question
May
11
comment How can I implement ansible with per-host passwords, securely?
The ansible_sudo_pass option seems new, too — and seems to do what I was asking for. A single vault password is ideal for my purposes, as well. Thanks!
Apr
9
awarded  Nice Question
Mar
11
awarded  Yearling
Dec
31
comment How can I implement ansible with per-host passwords, securely?
One comment, though, on your suggestion about restricting to "pre-approved" sudo commands (which did occur to me when I discovered that NOPASSWD is pretty much required). Unfortunately, this seems completely unsupported as well -- ansible makes no promises about calling e.g. chown or mkdir binaries directly, and needs to be able to sudo /bin/sh for most modules to work.
Dec
31
comment How can I implement ansible with per-host passwords, securely?
Thanks, @Zeb -- I had imagined that users with dozens-to-thousands of servers would use NOPASSWD for sanity reasons anyway (probably supported by tighter firewall rules etc.), but it's good to read your use-case and thoughts on the threat model.
Dec
29
awarded  Commentator
Dec
29
comment How can I implement ansible with per-host passwords, securely?
i.e. the ansible_ssh_password setting only applies to the SSH password (the clue is in the name...). & I'm already using key-based SSH login.
Dec
29
comment How can I implement ansible with per-host passwords, securely?
@senorsmile thanks for the response! Would you mind making it into an answer instead so I can downvote you for not reading the question?
Dec
24
comment How can I implement ansible with per-host passwords, securely?
@senorsmile thanks, but no that's not what I'm looking for. The "Basic Ansible Playbooks" article I quoted above mentions root login, and I agree with the author's view that it's not secure enough.
Dec
19
comment How can I implement ansible with per-host passwords, securely?
I am already using SSH keys; they don't affect sudo (which should still require a password).
Dec
18
comment How to resolve the gunicorn critical worker timeout error?
Can you provide more information, please? The command-line you're using to launch Gunicorn would be a good start.
Dec
9
asked How can I implement ansible with per-host passwords, securely?
Aug
16
awarded  Notable Question
Aug
23
comment Collating cron output for periodic e-mails
Perfect, thanks. Not sure how I missed the -s option in the man page.
Aug
23
accepted Collating cron output for periodic e-mails