Chapter 7. Encrypting plaintext passwords in automation controller configuration files

Procedure

1. On your automation controller node, run the following:

   # awx-manage shell_plus

2. Then run the following from the python prompt:

   >>> from awx.main.utils import encrypt_value, get_encryption_key \
   >>> postgres_secret = encrypt_value('$POSTGRES_PASS') \
   >>> print(postgres_secret)

   Note

   Replace the $POSTGRES_PASS variable with the actual plain text password you want to encrypt.

   The output should resemble the following:

   $encrypted$UTF8$AESCBC$Z0FBQUFBQmtLdGNRWXFjZGtkV1ZBR3hkNGVVbFFIU3hhY21UT081eXFkR09aUWZLcG9TSmpndmZYQXFyRHVFQ3ZYSE15OUFuM1RHZHBqTFU3S0MyNEo2Y2JWUURSYktsdmc9PQ==

3. Copy the full values of these hashes and save them.

   • The hash value begins with $encrypted$, and is not just the string of characters, as shown in the following example:

     $encrypted$AESCBC$Z0FBQUFBQmNONU9BbGQ1VjJyNDJRVTRKaFRIR09Ib2U5TGdaYVRfcXFXRjlmdmpZNjdoZVpEZ21QRWViMmNDOGJaM0dPeHN2b194NUxvQ1M5X3dSc1gxQ29TdDBKRkljWHc9PQ==

     Note that the $*_PASS values are already in plain text in your inventory file.

Procedure

1. Edit /etc/tower/conf.d/postgres.py using:

   $ vim /etc/tower/conf.d/postgres.py

2. Add the following line to the top of the file.

   from awx.main.utils import decrypt_value, get_encryption_key

3. Remove the password value listed after 'PASSWORD': and replace it with the following line, replacing the supplied value of $encrytpted.. with your own hash value:

   decrypt_value(get_encryption_key('value'),'$encrypted$AESCBC$Z0FBQUFBQmNONU9BbGQ1VjJyNDJRVTRKaFRIR09Ib2U5TGdaYVRfcXFXRjlmdmpZNjdoZVpEZ21QRWViMmNDOGJaM0dPeHN2b194NUxvQ1M5X3dSc1gxQ29TdDBKRkljWHc9PQ=='),

   Note

   The hash value in this step is the output value of postgres_secret.

4. The full postgres.py resembles the following:

   # Ansible Automation platform controller database settings. from awx.main.utils import decrypt_value, get_encryption_key DATABASES = { 'default': { 'ATOMIC_REQUESTS': True, 'ENGINE': 'django.db.backends.postgresql', 'NAME': 'awx', 'USER': 'awx', 'PASSWORD': decrypt_value(get_encryption_key('value'),'$encrypted$AESCBC$Z0FBQUFBQmNONU9BbGQ1VjJyNDJRVTRKaFRIR09Ib2U5TGdaYVRfcXFXRjlmdmpZNjdoZVpEZ21QRWViMmNDOGJaM0dPeHN2b194NUxvQ1M5X3dSc1gxQ29TdDBKRkljWHc9PQ=='), 'HOST': '127.0.0.1', 'PORT': 5432, } }

Procedure

1. When encryption is completed on all nodes, perform a restart of services across the cluster using:

   # automation-controller-service restart

2. Navigate to the UI, and verify you are able to run jobs across all nodes.