Guidance on communication, logging, and privileges in Ansible defaults.
| Article | Path |
|---|---|
| Sensitive data exposure in Ansible default logging settings | ansible/config/logging_of_sensitive_data_in_defaults |
| Ansible enables the legacy allow_unsafe_lookups option | ansible/config/allow_unsafe_lookups_enabled_in_defaults |
| Ansible Galaxy server uses HTTP | ansible/config/communication_over_http_in_defaults |
| Review Ansible’s default user-switching settings | ansible/config/privilege_escalation_using_become_plugin_in_defaults |
Apply no_log to sensitive task output, and protect debugging output and log stores separately.
On older Ansible versions, enabling allow_unsafe_lookups can allow external data to be evaluated again as a template. Review how lookup results are used and trusted in the version you run.
Use HTTPS and certificate verification for Galaxy server connections.
Enable user switching only where required and verify the execution account.
