The SSH issue is still an issue if I"m letting this daemon run as root on tower, because anyone can just inject code if they can break into this box...
On Monday, September 22, 2014 5:31:09 PM UTC-7, Michael DeHaan wrote: > > So a very good option for key management would be ansible tower - > http://ansible.com/tower > > Let Tower hold on to your key, and nobody will see it. It will use > ssh-agent behind the scenes (your key may be locked with a password or not) > and only allow that key to be used for running Ansible playbooks. > > (The key is saved encrypted in the database) > > I'd also consider setting things up so something like an "ansible" user > can sudo. It isn't strictly required, but might help a little bit with > tracking who does what. > > (Tower also keeps good logs of this) > > > > On Mon, Sep 22, 2014 at 8:23 PM, Kevin Burton <[email protected] > <javascript:>> wrote: > >> Right now I just manually SSH into a box in our cluster and run ansible. >> >> But I want to automate this... Ideally I could just bump the version >> number in my code when I want it released... and 2 minutes later it would >> be staged, tested, and deployed. >> >> But the issue is SSH auth.. many of my daemons need root. I don't >> necessarily want to have keys just sitting there giving anyone full access >> to my cluster. >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Ansible Project" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To post to this group, send email to [email protected] >> <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/ansible-project/57b954e7-48a8-491a-8e64-7d7168c1b534%40googlegroups.com >> >> <https://groups.google.com/d/msgid/ansible-project/57b954e7-48a8-491a-8e64-7d7168c1b534%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> For more options, visit https://groups.google.com/d/optout. >> > > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/0b684ce8-dea1-4edc-b698-1cc07d0b8afe%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
