257 reputation
29
bio website supervacuo.com
location United Kingdom
age
visits member for 4 years, 1 month
seen Aug 4 at 15:08

Jun
15
awarded  Popular Question
May
11
comment How can I implement ansible with per-host passwords, securely?
The ansible_sudo_pass option seems new, too — and seems to do what I was asking for. A single vault password is ideal for my purposes, as well. Thanks!
Apr
9
awarded  Nice Question
Mar
11
awarded  Yearling
Dec
31
comment How can I implement ansible with per-host passwords, securely?
One comment, though, on your suggestion about restricting to "pre-approved" sudo commands (which did occur to me when I discovered that NOPASSWD is pretty much required). Unfortunately, this seems completely unsupported as well -- ansible makes no promises about calling e.g. chown or mkdir binaries directly, and needs to be able to sudo /bin/sh for most modules to work.
Dec
31
comment How can I implement ansible with per-host passwords, securely?
Thanks, @Zeb -- I had imagined that users with dozens-to-thousands of servers would use NOPASSWD for sanity reasons anyway (probably supported by tighter firewall rules etc.), but it's good to read your use-case and thoughts on the threat model.
Dec
29
awarded  Commentator
Dec
29
comment How can I implement ansible with per-host passwords, securely?
i.e. the ansible_ssh_password setting only applies to the SSH password (the clue is in the name...). & I'm already using key-based SSH login.
Dec
29
comment How can I implement ansible with per-host passwords, securely?
@senorsmile thanks for the response! Would you mind making it into an answer instead so I can downvote you for not reading the question?
Dec
24
comment How can I implement ansible with per-host passwords, securely?
@senorsmile thanks, but no that's not what I'm looking for. The "Basic Ansible Playbooks" article I quoted above mentions root login, and I agree with the author's view that it's not secure enough.
Dec
19
comment How can I implement ansible with per-host passwords, securely?
I am already using SSH keys; they don't affect sudo (which should still require a password).
Dec
18
comment How to resolve the gunicorn critical worker timeout error?
Can you provide more information, please? The command-line you're using to launch Gunicorn would be a good start.
Dec
9
asked How can I implement ansible with per-host passwords, securely?
Aug
16
awarded  Notable Question
Aug
23
comment Collating cron output for periodic e-mails
Perfect, thanks. Not sure how I missed the -s option in the man page.
Aug
23
accepted Collating cron output for periodic e-mails
Aug
6
asked Collating cron output for periodic e-mails
May
31
comment Can 32-bit Linux use all 4 GB of RAM without a PAE kernel?
It would be excellent to get a source on this assertion...
Mar
6
revised How to access a subdomain of an IP address?
fixed typos
Aug
28
awarded  Popular Question