https://github.com/nekmo/ansible-keepass

Use become (sudo) in Ansible without giving any password and safely
https://github.com/nekmo/ansible-keepass

ansible keepass keepassxc password sudo

Last synced: 23 days ago
JSON representation

Use become (sudo) in Ansible without giving any password and safely

• Host: GitHub
• URL: https://github.com/nekmo/ansible-keepass
• Owner: Nekmo
• Created: 2018-11-17T17:16:30.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2020-04-21T19:27:04.000Z (over 4 years ago)
• Last Synced: 2024-10-04T13:07:30.077Z (about 1 month ago)
• Topics: ansible, keepass, keepassxc, password, sudo
• Language: Python
• Homepage:
• Size: 15.6 KB
• Stars: 25
• Watchers: 3
• Forks: 5
• Open Issues: 7
• Metadata Files:
  • Readme: README.rst

Awesome Lists containing this project

README

        
Ansible Keepass Plugin

######################

Use **become** (sudo) in Ansible **without giving any password** and safely. This plugin connects to

**keepassHTTP** or **KeepassXC Browser** to request the password. The connection is encrypted and requires a first

confirmation. The token for Keepass HTTP is stored using the keyring of the system and the passwords are only

accessible while the Keepass database is open.

Installation

============

Clone or copy the plugin included::

    sudo mkdir -p /usr/local/share/ansible/plugins/vars

    sudo curl https://raw.githubusercontent.com/Nekmo/ansible-keepass/master/ansible_keepass.py \

         -o /usr/local/share/ansible/plugins/vars/ansible_keepass.py

Set the var plugins directory to the same directory that contains ``ansible_keepass.py`` in ``ansible.cfg``::

    /etc/ansible/ansible.cfg

    ------------------------

    [defaults]

    ...

    vars_plugins = /usr/local/share/ansible/plugins/vars

And install requirements from ``requirements.txt`` file in this project (install the modules in the same environment

as Ansible)::

    sudo pip install -r requirements.txt

Usage

=====

This project supports **KeepassHTTP** and **KeepassXC Browser**. This plugin is able to detect your Keepass

program automatically but if you have issues define the environment variable ``KEEPASS_CLASS`` (available values:

``KeepassXC`` and ``KeepassHTTP``).

*Ansible-keepass* uses the url of the entry to find the entry to use. In the Keepass entries you must specify the url

using the name of the inventory or inventory group. For example::

    ssh:

Or including username::

    ssh:@

That is all! If you do not set a password now Ansible will ask Keepass for the password. You can try this plugin using::

    $  ansible  -a "/usr/bin/hdparm -C /dev/sda" --become

Security

========

These are the security measures adopted by Keepass and this plugin:

#. Keepass requests link permission the first time. This plugin stores the session using the OS Keyring.

#. Keepass can authorize access permission for each key individually.

#. Keys can not be listed using Keepass HTTP/XC Browser. A possible attacker must know key urls.

#. The connection between this plugin and Keepass is encrypted.

#. Passwords are not accessible while the Keepass database is closed.

This plugin can be more secure than copy&paste: a malware installed on your machine can listen for changes

in the clipboard. This plugin depends on the security of the OS Keyring and your personal password.