changing root password with an ansible playbook

Question

It is with great difficulty that I resolved to solve my problem, so I allow myself to submit here the solution.

I wanted a playbook that could replace on all hosts the root password with a string containing the last 3 digits of the IP address of the remote host.

Example: suppose the password is my_password and my LAN is 172.1.1.0/24. I wanted to set my_password@111 on the host with IP 172.1.1.111, my_password@112 on IP 172.1.1.112, and so on.

Here is the solution i propose:

- hosts: test

  vars:
    shared_string: my_very_secure_password

  tasks:

   - debug: 
       msg: "Remote IP host is {{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"

   - name: Extract last digits of remote host ip
     set_fact:
        last_digits: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] | regex_search(regexp) }}"
     vars:
        regexp: '\d{1,3}$'

   - debug:
        msg: "Last digits are {{ last_digits }}"

   - name: Compose and encrypt the password as shared_string@last_digits
     command: openssl passwd -crypt "{{ shared_string }}@{{ last_digits }}"
     register: crypted_password

   - debug: 
       msg: "clear password is {{ shared_string }}@{{ last_digits }}"
   - debug: 
       msg: "crypted password is {{ crypted_password.stdout }}"

   - name: Change root password
     user: name=root update_password=always password={{ crypted_password.stdout }}

what do you think, how to improve it?

Answer 1

For starter, I’d remove debug messages: they do nothing except leaking sensitive information. If you want a deeper sense of what is going on when running your playbook, you can always invoke Ansible with the verbose (-v) option.

Second, I would not use vars to store a password. Instead, I would ask it to the user using a vars_prompt. In fact, using a prompt to update a user password seems so common a need that Ansible itself provide this very possibility; but here you want to automatically append something else, so I’d reuse part of your approach.

The playbook I’d use would be:

- hosts: test

  vars_prompt:
    - name: shared_string
    - prompt: "Common base for your passwords? "
    - private: yes

  tasks:
   - name: Extract last digits of remote host ip
     set_fact:
        last_digits: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] | regex_search(regexp) }}"
     vars:
        regexp: '\d{1,3}$'

   - name: Compose and encrypt the password as shared_string@last_digits
     command: openssl passwd -crypt "{{ shared_string }}@{{ last_digits }}"
     register: crypted_password

   - name: Change root password
     user: name=root update_password=always password={{ crypted_password.stdout }}