[miro@controlnode vault]$ cat secure_var\r\nmessage: \"Hello world\"<\/pre>\nFile with password:<\/p>\n
[miro@controlnode vault]$ cat vault\r\nexample_of_password<\/pre>\nThe file with password (vault<\/code>) should be stored securely because if somebody gets this file, he can decrypt secure_var<\/code> file.<\/p>\nNow we can encrypt file with vars (secure_var<\/code>) using the label prod<\/code> in the “vault” file:<\/p>\n[miro@controlnode vault]$ ansible-vault encrypt --vault-id prod@vault secure_var\r\nEncryption successful\r\n\r\n[miro@controlnode vault]$ cat secure_var\r\n$ANSIBLE_VAULT;1.2;AES256;prod\r\n61386632306362663233343663383435666334303530613331396337613962383035376132656530\r\n3835353062303932373536636633343166373666663238390a396531343930366439386663393563\r\n61306235343664646233623739393065373034663837633065663666643164636262353732393339\r\n6439363665393561360a393863666565366635306661643135613138653234386663306236313539\r\n30303334633331303230613237626336396138313636653935316164356362633236\r\n<\/pre>\nLets’s run the playbook now:<\/p>\n
[miro@controlnode vault]$ ansible-playbook vault.yml\r\nERROR! Attempting to decrypt but no vault secrets found<\/pre>\nWe must specify the vault password file with --vault-id<\/code> file:<\/p>\n[miro@controlnode vault]$ ansible-playbook vault.yml --vault-id prod@vault\r\n\r\nPLAY [localhost] *****************************************************************************************************************\r\n\r\nTASK [Gathering Facts] ***********************************************************************************************************\r\nok: [localhost]\r\n\r\nTASK [Output message] ************************************************************************************************************\r\nchanged: [localhost]\r\n\r\nPLAY RECAP ***********************************************************************************************************************\r\nlocalhost : ok=2 changed=1 unreachable=0 failed=0\r\n\r\n[miro@controlnode vault]$ cat deployed.txt\r\nHello world<\/pre>\nAnd the playbook runs without problems.<\/p>\n
Now let’s run the same playbook with verbosity flag:<\/p>\n
[miro@controlnode vault]$ ansible-playbook -v vault.yml --vault-id prod@vault\r\nUsing \/etc\/ansible\/ansible.cfg as config file\r\n\r\nPLAY [localhost] ************************************************************************************************************************************************************************\r\n\r\nTASK [Gathering Facts] ******************************************************************************************************************************************************************\r\nok: [localhost]\r\n\r\nTASK [Output message] *******************************************************************************************************************************************************************\r\nchanged: [localhost] => {\"changed\": true, \"cmd\": \"echo Hello world<\/strong> > \/home\/miro\/ansible\/vault\/deployed.txt\", \"delta\": \"0:00:00.003909\", \"end\": \"2020-04-18 15:18:57.860573\", \"rc\": 0, \"start\": \"2020-04-18 15:18:57.856664\", \"stderr\": \"\", \"stderr_lines\": [], \"stdout\": \"\", \"stdout_lines\": []}\r\n\r\nPLAY RECAP ******************************************************************************************************************************************************************************\r\nlocalhost : ok=2 changed=1 unreachable=0 failed=0<\/pre>\nAnd we see that even we encrypt the secure_var file the meesage var can be seen.<\/p>\n
Let’s modify the playbook no to log the output:<\/p>\n
[miro@controlnode vault]$ cat vault.yml\r\n---\r\n- hosts: localhost\r\n vars_files:\r\n - \/home\/miro\/ansible\/vault\/secure_var\r\n tasks:\r\n - name: Output message\r\n shell: echo {{ message}} > \/home\/miro\/ansible\/vault\/deployed.txt\r\n no_log: true\r\n\r\n[miro@controlnode vault]$\r\n[miro@controlnode vault]$\r\n[miro@controlnode vault]$ ansible-playbook -v vault.yml --vault-id prod@vault\r\nUsing \/etc\/ansible\/ansible.cfg as config file\r\n\r\nPLAY [localhost] ************************************************************************************************************************************************************************\r\n\r\nTASK [Gathering Facts] ******************************************************************************************************************************************************************\r\nok: [localhost]\r\n\r\nTASK [Output message] *******************************************************************************************************************************************************************\r\nok: [localhost] => {\"censored\": \"the output has been hidden due to the fact that 'no_log: true' was specified for this result\"}\r\n\r\nPLAY RECAP ******************************************************************************************************************************************************************************\r\nlocalhost : ok=2 changed=1 unreachable=0 failed=0<\/pre>\nAnd the output has ben hidden.<\/p>\n
<\/p>\n
Example 1.<\/span><\/p>\nIn this exercise, you will create a new encrypted file, edit the file, and change the password on an existing encrypted file. You would also learn how to encrypt and decrypt an existing file.<\/p>\n
Create an encrypted file named super-secret.yml under ~\/ansible\/vault.
\nEnter redhat as the vault password when prompted, and confirm.<\/p>\n
[miro@controlnode vault]$ ansible-vault create super-secret.yml\r\nNew Vault password:\r\nConfirm New Vault password:<\/pre>\nEnter the following content into the file. Save and exit the file when you are finished.<\/p>\n
This is encrypted.<\/pre>\nAttempt to view the content of the encrypted file super-secret.yml.<\/p>\n
[miro@controlnode vault]$ cat super-secret.yml\r\n$ANSIBLE_VAULT;1.1;AES256\r\n30623932663266303862663737666561386666383065623665346361373333623131393661626262\r\n6362663464346266633162376130363737303632633232620a346265303061663764383834346465\r\n33303166333561373637376566303739653631386636613334303162303864353031373337653833\r\n6239666463383333390a323330646363343566353735343364626239326365323862643837353863\r\n61333830353566643235613366613165626365366236343539616431366661373139<\/pre>\nAs the file super-secret.yml is an encrypted file, you cannot view the content in plain text. The default cipher used is AES (which is shared-secret based).<\/p>\n
To view the content of the Ansible Vault encrypted file, use the command ansible-vault view super-secret.yml. When prompted, enter the vault password as redhat.<\/p>\n
[miro@controlnode vault]$ ansible-vault view super-secret.yml\r\nVault password:\r\nThis is encrypted.<\/pre>\nNow edit the encrypted file super-secret.yml to add some new content. Use redhat as the vault password.<\/p>\n
[miro@controlnode vault]$ ansible-vault edit super-secret.yml\r\nVault password:<\/pre>\nEnter the following content into the file. Save and exit the file when you are finished.<\/p>\n
This is also encrypted.<\/pre>\nVerify by viewing the content of super-secret.yml, using ansible-vault view
\nsuper-secret.yml. Use the vault password as redhat.<\/p>\n
[miro@controlnode vault]$ ansible-vault view super-secret.yml\r\nVault password:\r\nThis is encrypted.\r\nThis is also encypted.<\/pre>\nCreate file with password:<\/p>\n
[miro@controlnode vault]$ echo 'user_pw: 5pjsBJxAWUs6pRWD5itO\/' > passwd<\/pre>\nEncrypt file password<\/p>\n
[miro@controlnode vault]$ ansible-vault encrypt passwd\r\nNew Vault password:\r\nConfirm New Vault password:\r\nEncryption successful<\/pre>\nChange the vault password of the passwd<\/p>\n
[miro@controlnode vault]$ ansible-vault rekey passwd\r\nVault password:\r\nNew Vault password:\r\nConfirm New Vault password:\r\nRekey successful<\/pre>\nDecrypt the encrypted file passwd.yml and save the file as passwd-decrypted<\/p>\n
[miro@controlnode vault]$ ansible-vault decrypt passwd --output=passwd-decrypted\r\nVault password:\r\nDecryption successful\r\n[miro@controlnode vault]$ cat passwd-decrypted\r\nuser_pw: 5pjsBJxAWUs6pRWD5itO\/<\/pre>\nEncrypt the existing file passwd-decrypted.yml and save the file as passwd-encrypted<\/p>\n
[miro@controlnode vault]$ ansible-vault encrypt passwd-decrypted --output=passwd-encrypted\r\nNew Vault password:\r\nConfirm New Vault password:\r\nEncryption successful\r\n[miro@controlnode vault]$ cat passwd-encrypted\r\n$ANSIBLE_VAULT;1.1;AES256\r\n31616630343665666663393336316637333837616561323033393063326361333434623839646635\r\n6132613232306462633833636235363966633562393733640a383266393463613265323662363430\r\n35343330346430653066643732623031623863353131366336376465626465643330356230346335\r\n6562383561353366360a363833313963653362316137396566646534396135306164393863346664\r\n63656632623339396164313531396665323265303963343632333766353166333462<\/pre>\n <\/p>\n
Example 2.<\/span><\/p>\nCreate an encrypted file named secret.yml in ~\/ansible\/vault\/vars\/ which
\nwill contain sensitive playbook variables. Provide a password of redhat for the vault and confirm it.<\/p>\n
[miro@controlnode vault]$ mkdir vars\r\n[miro@controlnode vault]$ ansible-vault create vars\/secret.yml\r\nNew Vault password:\r\nConfirm New Vault password:\r\n\r\n[miro@controlnode vault]$ ansible-vault view vars\/secret.yml\r\nVault password:\r\n\r\nnewusers:\r\n- name: demouser1\r\npw: redhat\r\n- name: demouser2\r\npw: RedHat\r\n<\/pre>\nCreate the create_users.yml playbook. Note how it references vars\/
\nsecret.yml as an external playbook variables file.<\/p>\n
[miro@controlnode vault]$ cat create_users.yml\r\n---\r\n- name: create user accounts for all our servers\r\n hosts: managedhost1\r\n become: yes\r\n vars_files:\r\n - vars\/secret.yml\r\n tasks:\r\n - name: Creating users from secret.yml\r\n user:\r\n name: \"{{ item.name }}\"\r\n password: \"{{ item.pw | password_hash('sha512') }}\"\r\n with_items: \"{{ newusers }}\"<\/pre>\nUse ansible-playbook –syntax-check to check the syntax of the
\ncreate_users.yml playbook,<\/p>\n
[miro@controlnode vault]$ ansible-playbook --syntax-check create_users.yml\r\nERROR! Attempting to decrypt but no vault secrets found<\/pre>\nIt failed because it was unable to decrypt vars\/secret.yml to check its syntax. Add the –ask-vault-pass option to prompt for the vault password while decrypting vars\/secret.yml.<\/p>\n
[miro@controlnode vault]$ ansible-playbook --syntax-check --ask-vault-pass create_users.yml\r\nVault password:\r\n\r\nplaybook: create_users.yml<\/pre>\nCreate a password file, called vault-pass, to use for the playbook execution instead of asking for a password. Store the vault password redhat as plain text. Change the permission of the file to 0600.<\/p>\n
[miro@controlnode vault]$ echo 'redhat' > vault-pass\r\n[miro@controlnode vault]$ chmod 0600 vault-pass<\/pre>\nExecute the Ansible playbook, this time using the vault password file. This creates the demouser1 and demouser2 users on the managed hosts using the passwords stored as the pw fields in secret.yml.<\/p>\n
[miro@controlnode vault]$ ansible-playbook --vault-password-file=vault-pass create_users.yml\r\n\r\nPLAY [create user accounts for all our servers] ******************************************************************************\r\n\r\nTASK [Gathering Facts] *******************************************************************************************************\r\nok: [managedhost1]\r\n\r\nTASK [Creating users from secret.yml] ****************************************************************************************\r\nchanged: [managedhost1] => (item={u'name': u'demouser1', u'pw': u'redhat'})\r\nchanged: [managedhost1] => (item={u'name': u'demouser2', u'pw': u'RedHat'})\r\n\r\nPLAY RECAP *******************************************************************************************************************\r\nmanagedhost1 : ok=2 changed=1 unreachable=0 failed=0<\/pre>\nVerify that both users (demouser1 and demouser2) were created properly by the playbook. Connect to managedhost1 via SSH as those users.<\/p>\n
[miro@controlnode vault]$ ssh demouser1@managedhost1\r\ndemouser1@managedhost1's password:\r\nThis is the system managedhost1.\r\nToday's date is: 2020-05-06.\r\nOnly use this system with permission.\r\nYou can ask someone@host.example.com for access.\r\n[demouser1@managedhost1 ~]$ logout\r\nConnection to managedhost1 closed.\r\n\r\n[miro@controlnode vault]$ ssh demouser2@managedhost1\r\ndemouser2@managedhost1's password:\r\nPermission denied, please try again.\r\ndemouser2@managedhost1's password:\r\nLast failed login: Mon May 11 18:11:09 CEST 2020 from controlnode.example.com on ssh:notty\r\nThere was 1 failed login attempt since the last successful login.\r\nThis is the system managedhost1.\r\nToday's date is: 2020-05-06.\r\nOnly use this system with permission.\r\nYou can ask someone@host.example.com for access.\r\n[demouser2@managedhost1 ~]$ logout\r\nConnection to managedhost1 closed.<\/pre>\n <\/p>\n
Example 3.<\/span><\/p>\nIn this exercise, you will use Ansible Vault to encypt the file containing passwords on the local system and use that in a playbook to create users on the managedhost1 remote system.<\/p>\n
Create an encrypted file named secret2.yml in ~\/ansible\/vault\/. Provide
\na password of redhat for the vault and confirm it. This will open a file in the default editor vim.<\/p>\n
[miro@controlnode vault]$ ansible-vault create vars\/secret2.yml\r\nNew Vault password:\r\nConfirm New Vault password:\r\n\r\n[miro@controlnode vault]$ ansible-vault view vars\/secret2.yml\r\nVault password:\r\nnewusers:\r\n- name: ansibleuser1\r\n pw: redhat\r\n- name: ansibleuser2\r\n pw: Re4H1T\r\n<\/pre>\nCreate a playbook which will use the variables defined in the secret2.yml encrypted file. Name the playbook create_users2.yml and create it under the ~\/ansible\/vault\/ directory.\u00a0 Run this playbook as the miro user on the remote
\nmanaged host. Configure the playbook to create the ansibleuser1 and ansibleuser2 users.
\nThe password stored as plain text in the variable, pw, should be converted into password hash using hashing filters password_hash to get SHA512 hashed password and passed as an argument to the user module. For example,<\/p>\n
user:\r\n name: user1\r\n password: \"{{ 'example_of_password' | password_hash('sha512') }}\"<\/pre>\nThe content of the create_users.yml should be:<\/p>\n
[miro@controlnode vault]$ cat create_users2.yml\r\n---\r\n- name: create user accounts for all our servers\r\n hosts: managedhost1\r\n become: yes\r\n remote_user: miro\r\n vars_files:\r\n - vars\/secret2.yml\r\n tasks:\r\n - name: Creating users from secret.yml\r\n user:\r\n name: \"{{ item.name }}\"\r\n password: \"{{ item.pw | password_hash('sha512') }}\"\r\n with_items: \"{{ newusers }}\"<\/pre>\nCheck the syntax of the create_users.yml using ansible-playbook –syntaxcheck. Use the –ask-vault-pass option to prompt for the vault password set on secret.yml. In case of syntax error, resolve before continuing further.<\/p>\n
[miro@controlnode vault]$ ansible-playbook --syntax-check --ask-vault-pass create_users2.yml\r\nVault password:\r\n\r\nplaybook: create_users2.yml<\/pre>\nCreate a password file to use for the playbook execution instead of asking for a password. The file should be called vault-pass and it should store the redhat vault password as a plain text. Change the permission of the file to 0600.<\/p>\n
[miro@controlnode vault]$ echo 'redhat' > vault-pass2\r\n[miro@controlnode vault]$ chmod 0600 vault-pass2<\/pre>\nExecute the Ansible playbook, using the vault password file to create the ansibleuser1 and ansibleuser2 users on a remote system using the passwords stored as variables in the secret.yml Ansible Vault encrypted file. Use the vault password file vault-pass.<\/p>\n
[miro@controlnode vault]$ ansible-playbook --vault-password-file=vault-pass2 create_users2.yml\r\n\r\nPLAY [create user accounts for all our servers] ******************************************************************************\r\n\r\nTASK [Gathering Facts] *******************************************************************************************************\r\nok: [managedhost1]\r\n\r\nTASK [Creating users from secret.yml] ****************************************************************************************\r\nchanged: [managedhost1] => (item={u'name': u'ansibleuser1', u'pw': u'redhat'})\r\nchanged: [managedhost1] => (item={u'name': u'ansibleuser2', u'pw': u'Re4H1T'})\r\n\r\nPLAY RECAP *******************************************************************************************************************\r\nmanagedhost1 : ok=2 changed=1 unreachable=0 failed=0<\/pre>\nVerify that both users were created properly by the playbook by connecting via SSH to managedhost2.<\/p>\n
[miro@controlnode vault]$ ssh ansibleuser1@managedhost1\r\nansibleuser1@managedhost1's password:\r\nThis is the system managedhost1.\r\nToday's date is: 2020-05-06.\r\nOnly use this system with permission.\r\nYou can ask someone@host.example.com for access.\r\n[ansibleuser1@managedhost1 ~]$ logout\r\nConnection to managedhost1 closed.\r\n\r\n[miro@controlnode vault]$ ssh ansibleuser2@managedhost1\r\nansibleuser2@managedhost1's password:\r\nThis is the system managedhost1.\r\nToday's date is: 2020-05-06.\r\nOnly use this system with permission.\r\nYou can ask someone@host.example.com for access.\r\n[ansibleuser2@managedhost1 ~]$ logout\r\nConnection to managedhost1 closed.<\/pre>\n <\/p>\n
Example 4.<\/span><\/p>\nIn this lab, you will encrypt and decrypt the YAML file containing variables for LUKS encryption which are sensitive. Use the encrypted file containing variables in a playbook to execute remote tasks on serverb.lab.example.com to create a LUKS encrypted partition on \/dev\/vdb. Edit the encrypted role variable file to add the path of the new 256-bit key file and add tasks to insert this key to an available key slot on the encrypted device \/dev\/vdb on
\nmanagedhostx.<\/p>\n
Use the ansible-galaxy command to create a role named encryptdisk and its
\ndirectory structure.<\/p>\n
[miro@controlnode ansible]$ cd roles\r\n[miro@controlnode roles]$ ansible-galaxy init --offline encryptdisk\r\n- encryptdisk was created successfully<\/pre>\nEdit the encryptdisk role variable file, ~\/ansible\/roles\/encryptdisk\/
\nvars\/main.yml, to add the following variables:<\/p>\n
[miro@controlnode roles]$ cat encryptdisk\/vars\/main.yml\r\n---\r\n# vars file for encryptdisk\r\nluks_dev: \/dev\/vdb\r\nluks_name: crypto\r\nluks_pass: Re4H1TAns1BLe<\/pre>\nEncrypt the role variable file. Use redhat as the the vault password.
\nUse ansible-vault to encrypt the roles\/encryptdisk\/vars\/main.yml role variable
\nfile.<\/p>\n
[miro@controlnode roles]$ ansible-vault encrypt encryptdisk\/vars\/main.yml\r\nNew Vault password:\r\nConfirm New Vault password:\r\nEncryption successful\r\n\r\n[miro@controlnode roles]$ ansible-vault view encryptdisk\/vars\/main.yml\r\nVault password:\r\n---\r\n# vars file for encryptdisk\r\nluks_dev: \/dev\/vdb\r\nluks_name: crypto\r\nluks_pass: Re4H1TAns1BLe<\/pre>\nCreate task to encrypt a block device as specified using the luks_dev variable.<\/p>\n
TASK<\/pre>\nExample not finished<\/strong><\/em><\/p>\n <\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Ansible may need access to sensitive data such as passwords or API keys in order to configure remote servers. Normally, this information might be stored as plain text in inventory variables or other Ansible files. But in that case, any user with access to the Ansible files or a version control system which stores the … <\/p>\n
Continue reading “Ansible Vault”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":3329,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[86],"tags":[],"_links":{"self":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/3328"}],"collection":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/comments?post=3328"}],"version-history":[{"count":32,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/3328\/revisions"}],"predecessor-version":[{"id":3587,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/3328\/revisions\/3587"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media\/3329"}],"wp:attachment":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media?parent=3328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/categories?post=3328"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/tags?post=3328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}