Chapter 6 Network Reconnaissance

The best option is to “harden” code into a fresh repository after vaulting passwords and secrets. Migrate all folders and files, without the git history, into a fresh repository without passwords being visible. To get started either hard-code or prompt for credentials.

An alternative method is to prompt the user for credentials at run time. Hard-code the service account username and prompt for the password when the Ansible playbook is executed. This approach is secure however offers less flexibility for full automation as a password is required at run time. Ansible vars_prompt can be used to create interactive playbooks that prompt the user for username and password.

Be aware that as soon as Git commits the local changes the password becomes visible in the clear as part of the branch. After a pull request is merged the password becomes available in clear text as part of the master branch. This history cannot be deleted. It is part of the Git version control.

 Ansible vault: https://docs.ansible.com/ansible/2.7/user_guide/vault.html  Using vault in playbooks: https://docs.ansible.com/ansible/latest/user_guide/playbooks_vault.html  How to use vault to protect sensitive data on Ubuntu: https://www.digitalocean.com/community/tutorials/how-to-use-vault-to-protect-sensitive-ansible- data-on-ubuntu-16-04/  How Ansible vault works: https://serversforhackers.com/c/how-ansible-vault-works/  Ansible prompts: https://docs.ansible.com/ansible/latest/user_guide/playbooks_prompts.html Navigate to /group_vars/ and create a file called “all.yml” and replace the username / password with credentials that will allow Ansible to log into the devices.

--- 
 
ioscli: 
  username: "ServiceAccount" 
  password: "{{ Service Account Password}}" 
  host: "{{ inventory_hostname }}" 
  port: 22