Ansible vault guided exercise error (lab data-secret)

[dennisk]

Anyone experiencing the error when trying to run the lab? Lab was run by two people with same error. Syntax checks.

Playbook failed to execute.

[Travis · Accepted solution]

@dennisk 

Can you share your secret.yml file please? I'm not 100% sure without seeing, but based on my experience with that error, the password was placed in the file in PLAINTEXT instead of as a hash which will require that module to fail.

--- Travis

[dennisk]

Travis,

I don't have the file since it was created in a netlab pod but I know I didn't encrypt the password so I think your solution is 100% correct.

Thanks,

Dennis

[Travis]

@dennisk -

I know it probably doesn't help a lot now, but please feel free to look at my Github pages. I typically do some demos when I teach the course and for Ansible, I shared the playbooks on Github.

https://github.com/tmichett/RH294/tree/master/Ansible_Playbooks/Chapter4/data-secret

In this instance,  I have the secret file listed there directly.

https://github.com/tmichett/RH294/blob/master/Ansible_Playbooks/Chapter4/data-secret/CH4_GE_Managing...

To explain things a little bit further ...

https://docs.ansible.com/ansible/2.8/modules/user_module.html?highlight=user

Password:

Optionally set the user's password to this crypted value.

On macOS systems, this value has to be cleartext. Beware of security issues.

To create a disabled account on Linux systems, set this to '!' or '*'.

To create a disabled account on OpenBSD, set this to '*************'.

See https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module for details on various ways to generate these password values

https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-pa...

There are also other methods of doing this ... I'm assuming you were in the DO407 or the RH294 course performing a Vault lab for managing secrets. There is another Advanced Ansible course DO447: https://www.redhat.com/en/services/training/do447-advanced-automation-ansible-best-practices that dives into Ansible deeper mentioning proper version control with git and discusses usage of filters, etc.

In that course you learn things like ...

user:
  name: "{{ item }}"
  password: "{{ password | password_hash('sha512') }}" 
  update_password: on_create

[dennisk]

Thanks Travis. Checking with some else at the college who is also working on this, there seems to be some typos in the lab.