From f222b1c6158953efa8b01bb93a747630f53498f1 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Wed, 9 Sep 2026 21:04:35 +0200 Subject: [PATCH] fix(tasks): hide secret material written by the netrc and ssh key tasks The `no_log: true` on the include in tasks/main.yaml only censors the include statement and its loop item. It is not inherited by the included tasks, which was verified with a minimal playbook: a debug task inside an included file prints its message in clear even though the include itself is censored. Two tasks therefore leaked secrets. The netrc template exposes every machine password in its rendered content, and the copy of the private ssh keys exposes the key material itself. Both are printed by the diff mode, which is exactly the mode used when reviewing what a run would change. They are marked `no_log` individually now. The user task is deliberately left alone. Its `password` argument is declared `no_log` in the argument spec of the module, so ansible already censors it, and a task level flag would only make the remaining output useless. The blanket flag on the include stays in place, because the loop item still carries the plaintext password. Co-authored-by: Copilot --- tasks/create_unix_user.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tasks/create_unix_user.yaml b/tasks/create_unix_user.yaml index e52c964..2ba2c2d 100644 --- a/tasks/create_unix_user.yaml +++ b/tasks/create_unix_user.yaml @@ -96,6 +96,7 @@ owner: "{{ unix_user.key }}" group: "{{ unix_user.value.group | default('users') }}" mode: "0600" + no_log: true with_items: - "{{ unix_user.value.ssh.private_keys }}" when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0 @@ -177,3 +178,4 @@ owner: "{{ unix_user.key }}" group: "{{ unix_user.value.group | default('users') }}" mode: "0600" + no_log: true