Encrypt files on remote host

[Roman Steinhart]

Hi all,

I want to encrypt a file on a remote host. I was looking through the existing modules and couldn't find any that is able to do that?

My use case is that I want to create a backup (tar file) on a remote host, encrypt the backup archive and upload it to some storage.

I'm aware of Ansible vault, but it's intended purpose is for encrypting secrets etc. to use it in the playbook and not encrypting a remote file. 

Maybe someone has a suggestion.

Thanks!

~ Roman

[Stefan Hornburg (Racke)]

Hello Roman,

how would you do the encryption without Ansible?

Regards
Racke

>
> --
> You received this message because you are subscribed to the Google Groups "Ansible Project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com <mailto:ansible-proje...@googlegroups.com>.
> To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/d334642c-5982-480c-a4a1-76f6036131c6n%40googlegroups.com <https://groups.google.com/d/msgid/ansible-project/d334642c-5982-480c-a4a1-76f6036131c6n%40googlegroups.com?utm_medium=email&utm_source=footer>.


--
Ecommerce and Linux consulting + Perl and web application programming.
Debian and Sympa administration.

[Roman Steinhart]

Hi Stefan,

probably with openssl or gpg.

See 

https://gist.github.com/dreikanter/c7e85598664901afae03fedff308736b

https://www.gnupg.org/gph/en/manual/x110.html

I mean, I could do this with a basic shell module, but I'm wondering that there's no module fur such actions.

Thanks,

Roman

You received this message because you are subscribed to a topic in the Google Groups "Ansible Project" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/ansible-project/rRD_f5yiVBA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to ansible-proje...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/17fdd7e3-f072-96a1-9459-8acccc47343f%40linuxia.de.

[Stefan Hornburg (Racke)]

On 26/11/2021 11:39, 'Roman Steinhart' via Ansible Project wrote:
> Hi Stefan,
>
> probably with openssl or gpg.
> See

> https://gist.github.com/dreikanter/c7e85598664901afae03fedff308736b <https://gist.github.com/dreikanter/c7e85598664901afae03fedff308736b>
> https://www.gnupg.org/gph/en/manual/x110.html <https://www.gnupg.org/gph/en/manual/x110.html>

>
> I mean, I could do this with a basic shell module, but I'm wondering that there's no module fur such actions.
>

Hello Roman,

yeah, I guess you need to use the command module (not the shell module) or a dedicated backup software that does the encryption.

Regards
Racke

> Thanks,
> Roman

>
> On Thu, 25 Nov 2021 at 18:50, Stefan Hornburg (Racke) <ra...@linuxia.de <mailto:ra...@linuxia.de>> wrote:
>
> On 25/11/2021 18:22, 'Roman Steinhart' via Ansible Project wrote:
> > Hi all,
> >
> > I want to encrypt a file on a remote host. I was looking through the existing modules and couldn't find any that is able to do that?
> >
> > My use case is that I want to create a backup (tar file) on a remote host, encrypt the backup archive and upload it to some storage.
> >
> > I'm aware of Ansible vault, but it's intended purpose is for encrypting secrets etc. to use it in the playbook and not encrypting a remote file.
> > Maybe someone has a suggestion.
> > Thanks!
> > ~ Roman
>
> Hello Roman,
>
> how would you do the encryption without Ansible?
>
> Regards
>           Racke
>
> >
> > --
> > You received this message because you are subscribed to the Google Groups "Ansible Project" group.

> > To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com <mailto:ansible-project%2Bunsu...@googlegroups.com> <mailto:ansible-proje...@googlegroups.com <mailto:ansible-project%2Bunsu...@googlegroups.com>>.
> > To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/d334642c-5982-480c-a4a1-76f6036131c6n%40googlegroups.com <https://groups.google.com/d/msgid/ansible-project/d334642c-5982-480c-a4a1-76f6036131c6n%40googlegroups.com> <https://groups.google.com/d/msgid/ansible-project/d334642c-5982-480c-a4a1-76f6036131c6n%40googlegroups.com?utm_medium=email&utm_source=footer <https://groups.google.com/d/msgid/ansible-project/d334642c-5982-480c-a4a1-76f6036131c6n%40googlegroups.com?utm_medium=email&utm_source=footer>>.

>
>
> --
> Ecommerce and Linux consulting + Perl and web application programming.
> Debian and Sympa administration.
>
>
> --
> You received this message because you are subscribed to a topic in the Google Groups "Ansible Project" group.

> To unsubscribe from this topic, visit https://groups.google.com/d/topic/ansible-project/rRD_f5yiVBA/unsubscribe <https://groups.google.com/d/topic/ansible-project/rRD_f5yiVBA/unsubscribe>.
> To unsubscribe from this group and all its topics, send an email to ansible-proje...@googlegroups.com <mailto:ansible-project%2Bunsu...@googlegroups.com>.
> To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/17fdd7e3-f072-96a1-9459-8acccc47343f%40linuxia.de <https://groups.google.com/d/msgid/ansible-project/17fdd7e3-f072-96a1-9459-8acccc47343f%40linuxia.de>.

>
> --
> You received this message because you are subscribed to the Google Groups "Ansible Project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com <mailto:ansible-proje...@googlegroups.com>.

> To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CAKrGhHLC0QnxrmTBhZ8nb6G_Go4aQUia9uB9jOB55HO316EChQ%40mail.gmail.com <https://groups.google.com/d/msgid/ansible-project/CAKrGhHLC0QnxrmTBhZ8nb6G_Go4aQUia9uB9jOB55HO316EChQ%40mail.gmail.com?utm_medium=email&utm_source=footer>.

[Nico Kadel-Garcia]

On Monday, November 29, 2021 at 3:17:19 AM UTC-5 ra...@linuxia.de wrote:

On 26/11/2021 11:39, 'Roman Steinhart' via Ansible Project wrote:
> Hi Stefan,
>
> probably with openssl or gpg.
> See
> https://gist.github.com/dreikanter/c7e85598664901afae03fedff308736b <https://gist.github.com/dreikanter/c7e85598664901afae03fedff308736b>
> https://www.gnupg.org/gph/en/manual/x110.html <https://www.gnupg.org/gph/en/manual/x110.html>
>
> I mean, I could do this with a basic shell module, but I'm wondering that there's no module fur such actions.
>

Hello Roman,

yeah, I guess you need to use the command module (not the shell module) or a dedicated backup software that does the encryption.

Regards
Racke

Is it OK for an unencrypted copy of the backup to live on the to live on the remote storage, where it could be encrypted and uploaded? Ansible can have access to zip or GPG keys  configured, especially publishing pubic GPG keys for use on the server that hosts the unencrypted file. The GPG public key need not be a secret: it could be published to the remote host to encrypt the file locally before upload.