Using Pathword Authentication to run a Playbook

[JS]

Hello!

I have a single playbook that with various plays in it.

It goes out to different environments, either dev, uat, or prod (based on the --extra-vars input by the user deploying the playbook). 

i.e. ansible-playbook -i hosts deploy.yml --extra-vars "env=uat"

Is there anyway I can set the ansible-playbook to require a password if a user selects the prod environment?

They should be allowed to deploy to dev and uat without any authentication or passwords.

Thanks

JS

[Kai Stian Olstad]

Since you use Pathword in the subject I guess you are after an hurdel so
users don't accidentally run against production?

If so, you can do something like this:

- pre_tasks:
- pause:
prompt: "You are running against production. What is the magic
word?"
register: result
when: env == 'prod'

- fail:
msg: "Aborting, wrong magic."
when: result.user_input | default('') != 'answerable' and env ==
'prod'


If not you could use password against production and keys on the other
environments.


--
Kai Stian Olstad

[Dick Davies]

What about not putting the users keys onto the production servers?

> --
> You received this message because you are subscribed to the Google Groups
> "Ansible Project" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ansible-proje...@googlegroups.com.
> To post to this group, send email to ansible...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/ansible-project/ee982bf7-dc4d-4555-9f1a-e46af6e2afdb%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[JS]

Hi Kai 

Fantastic, many thanks for your reply!

I'll give your play shot (I prefer having the keys setup as I have also made the playbooks available via Jenkins for automation!) and if that doesn't work I'll use the password authentication for Prod and Keys for the other environments!

Regards

JS

[JS]

Hi Dick

Fantastic, many thanks for your reply!

I'll give Kai's play above a shot (I prefer having the keys setup as I have also made the playbooks available via Jenkins for automation!) and if that doesn't work I'll use the password authentication for Prod and Keys for the other environments!

Regards

JS

[Timothy Brush]

Just starting to use Ansible but wouldn't this be better solved using a separate ssh key for prod systems that requires a password that only authorized personnel have access to and loading that key into ssh agent before running plays? Depending on you naming scheme, you may even be able to specify production hosts via wildcard in ~/.ssh/config file. This not only limits the ability to push to production but adds additional security.

Note: Ansible's user module can be used to push out new ssh authorized keys.

Apologies if this solution is off the mark but my background is in information security.

[JS]

Hi Kai

Thanks for that - it worked like a charm on the CLI!

- pre_tasks: 

   - pause: 

       prompt: "You are running against production. What is the magic word?" 

     register: result 

     when: env == 'prod' 

   - fail: 

       msg: "Aborting, wrong magic." 

       when: result.user_input | default('') != 'answerable' and env == 'prod'

I've integrated the playbook with Jenkins - so it doesn't work on there. I get the following error:  [WARNING]: Not waiting from prompt as stdin is not interactive

But I suppose that's not a problem as we can run DEV/UAT via Jenkins (GUI) and the PROD environment via CLI.

[Adrian Likins]

ansible-playbook isnt really the right tool for writing interactive tooling. There is some very limited support for it

but it is not a good approach.

Some of the previous mentioned suggestions  (password protected prod only ssh keys and ssh-agent...) will be

more useful in the long run. Or using a wrapper script to handle the interactivity if required.

But avoid trying to use ansible as an interactive tool.
 

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.

To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscribe@googlegroups.com.
To post to this group, send email to ansible-project@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/8bfcbdfc-a669-4f62-af4a-2b57fa05b30c%40googlegroups.com.