Ansible/Security: Difference between revisions
From charlesreid1
(Created page with "Security concerns when using Ansible. ===ansible.cfg and world writable directories=== {{Quote| If Ansible were to load :file:ansible.cfg from a world-writable current worki...") |
No edit summary |
||
| Line 10: | Line 10: | ||
- https://docs.ansible.com/ansible/latest/reference_appendices/config.html#ansible-configuration-settings | - https://docs.ansible.com/ansible/latest/reference_appendices/config.html#ansible-configuration-settings | ||
}} | }} | ||
{{AnsibleFlag}} | |||
Latest revision as of 16:51, 11 November 2018
Security concerns when using Ansible.
ansible.cfg and world writable directories
If Ansible were to load :file:ansible.cfg from a world-writable current working directory, it would create a serious security risk. Another user could place their own config file there, designed to make Ansible run malicious code both locally and remotely, possibly with elevated privileges. For this reason, Ansible will not automatically load a config file from the current working directory if the directory is world-writable.If you depend on using Ansible with a config file in the current working directory, the best way to avoid this problem is to restrict access to your Ansible directories to particular user(s) and/or group(s).
