09 Advanced features in Ansible | Mastering Ansible

Now let's talk about the use cases for interactive prompts using where prompts. Hey everyone, before we dive into today's Ansible session, I have something exciting to share. I am launching a complete mastering anible for beginners course very soon. And there's a link in the description to join my waiting list. And uh you will get early access, exclusive discounts, and be notified the moment it goes live. So imagine you're rolling out an update across your servers. Instead of hard-coding sensitive details or configurations, Ansible's where's prompt comes to the rescue. So here's how we can enhance security and flexibility. So in this example, we are asking the user by prompting for a username with where prompt. First is the username. We are asking where is your username and you can see here is a flag that is called private and it is set to false. And by setting priority equals to false we make the username input visible during the prompt. So while typing it'll be visible. And by default private the value that is uh by default is true which we use for password where we don't show what we typed. So this is a straightforward way to interact without revealing sensitive information like passwords. So if you don't want to have uh the values revealed during typing, you can just keep them as private equals to true or you can just leave it. It'll be private by default. Now let's take a look at the second example which is default variables in where prompts. Now let's say the release version changes infrequently. So with v prompt you can set a default. So if you skip the prompt, anible won't pause the play. It'll just use the version you have set as the standard. So if you can see here the VS prompt name is released version or release version but the default value is set to 1.0. So let's take another example that is the third example. Here as we know private hides the password that we enter. So that is why we have mentioned private equal to true. But there is another thing called unsafe. So which is used when you want to allow providing special characters in your v prompt. So let's suppose I have a password which has special characters and I want to allow them. So I will use a parameter that is unsafe and I'll mark it as true. So next example here is with hashing. So hashing with vas prompt. So we all understand that password should never be plain text right. So anible allows us to hash passwords or hash inputs on the fly. So when we prompt for a password, not only we can hide the input, but you can also hash it with methods like SHA 512 for secure storage. So here you can see the first thing the name that is my password to prompt is answer enter password to here you can see we have private is set to true which hides the entered password from the console output and answerable log files for enhanced security. What encrypt SHA 52 crypt does is that if it actually hashes the password using the SHA 512 crypt algorithm storing it securely instead of the plain text value and when it comes to confirm which is set to true it gives us additional option which prompts the user to re-enter the password for confirmation ensuring the accuracy that you have. So you have already used it I'm sure while creating an account in some web applications where it asks for a email address and it asks you to reenter the email address or password once again for confirmation. The new thing that you see here is salt size is 7. So what does this do? So this basically specifies the size of the random salt uh used during password hashing. So adding another type of another layer of protection. So for users who aren't aware of what salt is, so it refers to a cryptographic salt. So this is a random string of characters added to the password before hashing. So the reason for using a salt is to prevent attackers from using a premputed hash table or what we also call as rainbow tables to easily reverse the hash passwords. So even if two users choose the same password, adding a unique salt for each user makes their hashed password different. So that's a smart thing, isn't it? Effectively rendering rainbow tables useless. So that's a very good thing. The last thing that you see here is the option for using a special characters that I've already told you in web prompts and I have mentioned that. So if you need to use special characters, you can use the unsafe option. But having said that uh and I'm saying that the unsafe option exists in anible but I strongly advise against using it for accepting special characters in variables or templates. So bad thing on this is that this option bypasses security filters and exposes our playbooks to potential vulnerabilities. So make sure that you understand this. So I hope you understood the whole point here and the options available to us. Let's move on.