0
\$\begingroup\$

It is with great difficulty that I resolved to solve my problem, so I allow myself to submit here the solution.

I wanted a playbook that could replace on all hosts the root password with a string containing the last 3 digits of the IP address of the remote host.

Example: suppose the password is my_password and my LAN is 172.1.1.0/24. I wanted to set my_password@111 on the host with IP 172.1.1.111, my_password@112 on IP 172.1.1.112, and so on.

Here is the solution i propose:

- hosts: test

  vars:
    shared_string: my_very_secure_password

  tasks:

   - debug: 
       msg: "Remote IP host is {{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"

   - name: Extract last digits of remote host ip
     set_fact:
        last_digits: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] | regex_search(regexp) }}"
     vars:
        regexp: '\d{1,3}$'

   - debug:
        msg: "Last digits are {{ last_digits }}"

   - name: Compose and encrypt the password as shared_string@last_digits
     command: openssl passwd -crypt "{{ shared_string }}@{{ last_digits }}"
     register: crypted_password

   - debug: 
       msg: "clear password is {{ shared_string }}@{{ last_digits }}"
   - debug: 
       msg: "crypted password is {{ crypted_password.stdout }}"

   - name: Change root password
     user: name=root update_password=always password={{ crypted_password.stdout }}

what do you think, how to improve it?

\$\endgroup\$
3
  • \$\begingroup\$ Welcome to Code Review! What does openssl have to do with this question? \$\endgroup\$
    – Mast
    Sep 12, 2018 at 10:02
  • \$\begingroup\$ @Mast Because they use openssl to generate the encrypted version of the password? \$\endgroup\$ Sep 12, 2018 at 10:57
  • 1
    \$\begingroup\$ @MathiasEttinger Is that relevant for the question? They aren't re-implementing it, just calling it in a fairly standard method. \$\endgroup\$
    – Mast
    Sep 12, 2018 at 10:59

1 Answer 1

1
\$\begingroup\$

For starter, I’d remove debug messages: they do nothing except leaking sensitive information. If you want a deeper sense of what is going on when running your playbook, you can always invoke Ansible with the verbose (-v) option.

Second, I would not use vars to store a password. Instead, I would ask it to the user using a vars_prompt. In fact, using a prompt to update a user password seems so common a need that Ansible itself provide this very possibility; but here you want to automatically append something else, so I’d reuse part of your approach.

The playbook I’d use would be:

- hosts: test

  vars_prompt:
    - name: shared_string
    - prompt: "Common base for your passwords? "
    - private: yes

  tasks:
   - name: Extract last digits of remote host ip
     set_fact:
        last_digits: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] | regex_search(regexp) }}"
     vars:
        regexp: '\d{1,3}$'

   - name: Compose and encrypt the password as shared_string@last_digits
     command: openssl passwd -crypt "{{ shared_string }}@{{ last_digits }}"
     register: crypted_password

   - name: Change root password
     user: name=root update_password=always password={{ crypted_password.stdout }}
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.