9

I was looking at Ansible Vault which is used for encryption in Ansible playbooks. The Ansible documentation seems to be thin on details of how it works, apart from mentioning that the default cipher is AES. I can't confidently figure it out myself from the source code.

I can see the result of using ansible-vault to encrypt a test file:

$ANSIBLE_VAULT;1.1;
AES256   
DIGITS   
DIGITS   
etc.

I found this post which explains how to decrypt an Ansible-Vault-encrypted file using a patched version of openssl. Can anyone explain whether it's possible to decrypt an Ansible Vault file using vanilla tools not packaged with Ansible? (Assuming you know the password, of course).

Improve this question
2
  • This would be the place for this question, but it is really niche. If you wish, you can place a bounty on it to give it greater attention.
    – schroeder ♦
    Jun 21, 2016 at 14:38
  • 1
    Quoting: "Unfortunately, the Vault is also sort of a pain: every time I want to edit an encrypted file, or do a test run, I have to type my Super Complex Secret Passphrase. ...Fortunately, there's another way. Ansible has support for getting the Vault passphrase from a script" (blog.erincall.com/p/using-pgp-to-encrypt-the-ansible-vault original article). As for AES the config files dictate AES and AES256 is default but nothing more. Due to the fact it does not say: "Only uses AES or AES256" I would think other ciphers are supported
    – munkeyoto
    Jun 21, 2016 at 15:54

1 Answer 1

Reset to default
6

Ansible is open source, written in Python, and uses PyCrypto, a standard python cryptography library, not packaged with Ansible.

https://www.dlitz.net/software/pycrypto/

The module that handles encryption and decryption is VaultLib, here:

https://github.com/ansible/ansible/blob/adea1f2b80d806d94ca1bdb2d06f2df077feb948/lib/ansible/parsing/vault/init.py

That module looks to have only minimal dependencies on other Ansible modules- some python 3 compatibility stuff, some unicode stuff, a module called Display.

To make a "standalone" tool with a high likelihood of compatibility with Ansible, the best approach would be to take that code, remove the python 3 stuff, remove the Display module, and copy-paste in the unicode functions.

As long as PyCrypto and other python dependencies are installed, the encrypt and decrypt functions in that module should just work.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .