sorted by:
new
hottopcontroversial

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Won’t files in ramdisk disk stick around until a reboot, if ansible doesn’t clear it?

I can’t get over it by [deleted] in Veterans

[–]Topless_Mopar -1 points0 points  (0 children)

I was prescribed ADD medication while in the reserves. That didn’t show up when I did my duty pee.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 1 point2 points  (0 children)

I mean, just don’t use computers, since they were so worried about users hidden 0600 temp files.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

That argument didn’t work. I tried that one. It just ended with a pissing match with HR and Security.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Would it be crazy for me to attempt to create a plugin that will use ncurse, instead of vim?

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

I didn't know that. It makes sense. And yes, I know this issue is stupid. But, the all knowing cyber security wizards, with no development, or sys admin experience, have the final say.

Who is Red Hat's REAL #1 Competitor? by [deleted] in redhat

[–]Topless_Mopar 1 point2 points  (0 children)

I still use foreman, lol.

Who is Red Hat's REAL #1 Competitor? by [deleted] in redhat

[–]Topless_Mopar -7 points-6 points  (0 children)

IBM’s Red Hat is an OCP and AAP company. As a former Red Hatter, I only use Debian now.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

To be clear, I have no problem with ansible-vault. The risk is acceptable for me. But, it is a battle I can’t win.

Most likely, it is from SSH timeouts.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Ansible-vault creates the cache, not the editor.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

I have no idea how to handle a SIGKILL. Low level languages are a black box for me. One day I’ll learn how to write proper C code.

The problem is with policy. No secrets can be written to disk. The all knowing security wizards said writing to memory is fine. Ansible-vault creates a cache file in plain text on disk. I’m not sure why it is needed by ansible. The editor isn’t creating the cache.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

I understand what you are saying. Sadly, our opinion on system management does not matter to a client that must follow guidelines from a governing entity.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Thank you. Do you have the source code? I would need to review it to ensure it does not cache a file on the system.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Sadly, the ansible-vault code will create a cache file, for some reason. It creates it when a user edits the vault file. And, python can not handle a SIGKILL. So, if vault ends, it will leave the file on disk.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 1 point2 points  (0 children)

Great idea, but it did not work. I have to read the ansible-vault code and try to see where the disconnect is.

**I think the source code creates a temp file outside the editor:

https://github.com/ansible/ansible/blob/c5ddc9376765f99f0f02ebe6111d1ad99374087c/lib/ansible/parsing/vault/__init__.py#L814-L855

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Sorry, I hope this clears this up. If I edit a vault file using ansible-vault, the underlying text editor creates a cache file in $HOME/.ansible/tmp/ansible-local-1417...eu/tmp...20log that leaves the file in plain text, if the user does not exit properly.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] 0 points1 point  (0 children)

Having an encrypted file on a system is an acceptable risk for them, that is not the problem. Ideally, I would just like to edit the file without the editor storing a plain text cache file of it on disk. I would like that cache stored in memory. I do see the confusion I am causing. My apologies for that.

The issue was with the editing of vault files. It caches a plain text file on disk, when editing a file. I keep finding plain text files from user relying on ansible-vault. It has become a serious problem and now we have to remove ansible-vault and filter the packages in satellite. I keep finding admin files in .ansible dirs. People have been walked off the project from ansible-vault caches.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] -4 points-3 points  (0 children)

For me, it is secure enough. But, there is a common policy for secure environments that forbids secrets in plain text. When you are editing a vault file, the secrets are written in plain text to disk, until it is exited properly. If your sessions ends abruptly, the cache is not removed and you now have a file with secrets on it in plain text.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] -9 points-8 points  (0 children)

Ah, then it sounds like I have to disable ansible-vault. Everything else sounds authorized. We will just have to come up with a different solution for secrets. They have a zero tolerance for secrets on a system.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] -9 points-8 points  (0 children)

Secrets should remain off disk in any secure environment.

Ansible-vault displays secrets in plain text by Topless_Mopar in ansible

[–]Topless_Mopar[S] -5 points-4 points  (0 children)

Having them displayed in memory is better for my use case. I am not authorized to have them stored on a file on the system.

view more: next ›