Skip to content

Commit

Permalink
Do not show passwords in Ansible output
Browse files Browse the repository at this point in the history
This role prints passwords in Ansible outputs (e.g. when creating
users, etc.). This is a problem because passwords must never appear
in plaintext under any circunstances.

This commit attempts to fix the problem described above. The option
"no_log: true" has been added to tasks which may print passwords
during Ansible execution.
  • Loading branch information
David Castellanos committed Sep 21, 2016
1 parent d10f291 commit 01bcbcf
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 0 deletions.
3 changes: 3 additions & 0 deletions tasks/auth_initialization.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
password: "{{ mongodb_user_admin_password }}",
roles: "userAdminAnyDatabase"
}
no_log: true

- name: create administrative user siteRootAdmin
mongodb_user:
Expand All @@ -48,6 +49,7 @@
password: "{{ mongodb_root_admin_password }}",
roles: "root"
}
no_log: true

- name: create backup user "backupuser"
mongodb_user:
Expand All @@ -63,6 +65,7 @@
password: "{{ mongodb_root_backup_password }}",
roles: "backup,clusterMonitor"
}
no_log: true

- name: Move back mongod.conf
template: src=mongod.conf.j2 dest=/etc/mongod.conf owner=root group=root mode=0644
Expand Down
3 changes: 3 additions & 0 deletions tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
when: ( mongodb_security_authorization == 'enabled'
and (not mongodb_replication_replset
or mongodb_replication_replset == '') )
no_log: true
tags: [mongodb]

- name: Include authorization configuration
Expand Down Expand Up @@ -60,6 +61,7 @@
and mongodb_replication_replset != ''
and mongodb_security_authorization == 'enabled'
and mongodb_master is defined and mongodb_master )
no_log: true
tags: [mongodb]

- name: create normal users without replicaset
Expand All @@ -77,6 +79,7 @@
when: ( mongodb_security_authorization == 'enabled'
and (not mongodb_replication_replset
or mongodb_replication_replset == '') )
no_log: true
tags: [mongodb]

- name: Include MMS Agent configuration
Expand Down

0 comments on commit 01bcbcf

Please sign in to comment.