Reputation
356
Top tag
Next privilege 500 Rep.
Access review queues
Badges
4 10
Impact
~24k people reached

Apr
7
comment How can I implement ansible with per-host passwords, securely?
understood; I meant that I already have to use KeepassX to have access to passwords on non-GNOME systems, so storing them in gnome-keyring would mean keeping duplicate records. Still way nicer than using NOPASSWD, though…
Apr
2
comment How can I implement ansible with per-host passwords, securely?
This looks very neat, thank you — I like the idea of not having to store passwords in two places. At the moment I'm stuck using KeepassX (because the GNOME keyring doesn't seem very portable) but perhaps I can make python-keepass work?
Jan
25
comment How can I implement ansible with per-host passwords, securely?
@Jepper I use SSH keys to connect to servers as an unprivileged user and then want to sudo to run specific ansible modules which require it. It sounds like you're sticking to modules which don't, or you're SSHing as root -- neither of which seems ideal. Thanks, though!
May
11
comment How can I implement ansible with per-host passwords, securely?
The ansible_sudo_pass option seems new, too — and seems to do what I was asking for. A single vault password is ideal for my purposes, as well. Thanks!
Dec
31
comment How can I implement ansible with per-host passwords, securely?
One comment, though, on your suggestion about restricting to "pre-approved" sudo commands (which did occur to me when I discovered that NOPASSWD is pretty much required). Unfortunately, this seems completely unsupported as well -- ansible makes no promises about calling e.g. chown or mkdir binaries directly, and needs to be able to sudo /bin/sh for most modules to work.
Dec
31
comment How can I implement ansible with per-host passwords, securely?
Thanks, @Zeb -- I had imagined that users with dozens-to-thousands of servers would use NOPASSWD for sanity reasons anyway (probably supported by tighter firewall rules etc.), but it's good to read your use-case and thoughts on the threat model.
Dec
29
comment How can I implement ansible with per-host passwords, securely?
i.e. the ansible_ssh_password setting only applies to the SSH password (the clue is in the name...). & I'm already using key-based SSH login.
Dec
29
comment How can I implement ansible with per-host passwords, securely?
@senorsmile thanks for the response! Would you mind making it into an answer instead so I can downvote you for not reading the question?
Dec
24
comment How can I implement ansible with per-host passwords, securely?
@senorsmile thanks, but no that's not what I'm looking for. The "Basic Ansible Playbooks" article I quoted above mentions root login, and I agree with the author's view that it's not secure enough.
Dec
19
comment How can I implement ansible with per-host passwords, securely?
I am already using SSH keys; they don't affect sudo (which should still require a password).
Dec
18
comment How to resolve the gunicorn critical worker timeout error?
Can you provide more information, please? The command-line you're using to launch Gunicorn would be a good start.
Aug
23
comment Collating cron output for periodic e-mails
Perfect, thanks. Not sure how I missed the -s option in the man page.
May
31
comment Can 32-bit Linux use all 4 GB of RAM without a PAE kernel?
It would be excellent to get a source on this assertion...
Jul
22
comment Free / Open Source — Log Management appliances/platforms
Thanks for clarifying my spaghetti-verbiage! That's exactly what I'm trying to say — log parsing to get alerts is inserting an almost-always-unnecessary step in the process.
Jul
11
comment Monitoring NTBackup / Windows Server Backup using Nagios passive checks
Thanks for the answer; I was hoping to avoid log-parsing but I guess if there's no other way then I'll have to bite the bullet!
Jul
11
comment Monitoring NTBackup / Windows Server Backup using Nagios passive checks
Sorry, forgot to mention that I'm already using it! My problem is that although (after many hours of muddling through) CheckEventLog can WARN or CRIT if there are events matching a set of filters, it's not possible to raise an error if there isn't an expected event — the main problem with our backups is that occasionally backups don't run rather than running with errors. Thanks for the helpful explanation though!