Isn't password declared in plain text under vars when using kerberos ?

[Neeraj Shah]

Hi All,  

As per official docs, using ansible to manage windows hosts requires us to specify the password in plain text for ansible_winrm_transport variable in the hosts file or the group_vars file. My question or confusion is doesn't security take a beating here ?  In most cases we end up putting domain admin or local admin credentials here so how is this protected if the ansible linux host gets compromised ?  How is this supposed to be secured  ?

The following example shows host vars configured for Kerberos authentication:

ansible_user: user...@MY.DOMAIN.COM
ansible_password: Password
ansible_connection: winrm
ansible_winrm_transport: kerberos

[Jordan Borean]

There are multiple ways you can get around this, you could;

• Store the password in a vault file so the user would need to know the vault key when running your playbook
• Use a lookup plugin to lookup the password during runtime
• Don't use a password at all, kerberos can use the existing ticket checked out with kinit before running the playbook

You shouldn't have your password in plaintext at all, most of the time the docs only have it there just for documentation purposes.

Thanks

Jordan

[Neeraj Shah]

Thank you Jordan. 

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/b92f6b8b-d108-4a47-a911-ca21ce05f348%40googlegroups.com.