Wrong 'password_hash' module result for 'bcrypt' algorithm using willhallonline/ansible:2.12-bullseye image

[vreitech]

I tried to use 'password_hash' module in my playbook, and I got misbehavior when using 'bcrypt' algorithm with the module.

Example playbook:

$ cat _test18.yml 
- hosts: all
  tasks:
  - name: get hash
    debug:
      msg: "{{ 'asdfasdf' | password_hash('bcrypt', rounds=10, ident='2a') }}"

Actual behavior: Hash value is not meaningful.

$ podman run --rm -it -v $(pwd):/ansible \
docker.io/willhallonline/ansible:2.12-bullseye \
bash -c 'ansible-playbook -l localhost _test18.yml'

PLAY [all] ********************************************************

TASK [Gathering Facts] ********************************************
ok: [localhost]

TASK [get hash] ***************************************************
ok: [localhost] => {
    "msg": "*0"
}

PLAY RECAP ********************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Expected behavior: Meaningful hash value (something that starts from $2a$10$).

Suggested solution to the problem: It needs to be added installation of python3-passlib package into Dockerfile. Adding this into docker/podman run command solves the problem:

$ podman run --rm -it -v $(pwd):/ansible \
docker.io/willhallonline/ansible:2.12-bullseye \
bash -c 'apt-get -yq update; apt-get -yq install python3-passlib; ansible-playbook -l localhost _test18.yml'
Get:1 http://security.debian.org/debian-security bullseye-security InRelease [44.1 kB]
Get:2 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [39.4 kB]
Get:4 http://security.debian.org/debian-security bullseye-security/main amd64 Packages [164 kB]
Get:5 http://deb.debian.org/debian bullseye/main amd64 Packages [8182 kB]
Get:6 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [2592 B]
Fetched 8548 kB in 3s (3410 kB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
  python3-passlib
0 upgraded, 1 newly installed, 0 to remove and 4 not upgraded.
Need to get 368 kB of archives.
After this operation, 2097 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian bullseye/main amd64 python3-passlib all 1.7.4-1 [368 kB]
Fetched 368 kB in 0s (1557 kB/s)
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package python3-passlib.
(Reading database ... 19434 files and directories currently installed.)
Preparing to unpack .../python3-passlib_1.7.4-1_all.deb ...
Unpacking python3-passlib (1.7.4-1) ...
Setting up python3-passlib (1.7.4-1) ...

PLAY [all] ********************************************************

TASK [Gathering Facts] ********************************************
ok: [localhost]

TASK [get hash] ***************************************************
ok: [localhost] => {
    "msg": "$2a$10$l0AJxfvJ34moWsRtJGeFR.fdDbwU60mmxEX6tV/OK6.dHHcPYfVDS"
}

PLAY RECAP ********************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Environment:

$ grep -P '^(NAME|VERSION)=' /etc/os-release 
NAME="Fedora Linux"
VERSION="36 (KDE Plasma)"
$ uname -a
Linux admin200 5.17.14-300.fc36.x86_64 #1 SMP PREEMPT Thu Jun 9 13:41:46 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
$ podman --version
podman version 4.1.0

[pavelpikta]

Hi @vreitech

Hashing and encrypting strings and passwords

If passlib is not installed then the crypt module is used, only if crypt module cannot be used the error is triggered; looking at the crypt module might reveal what is the issue.

[willhallonline]

My thinking is that python3-passlib as a package could be added if a user requires, but that it is not distinctly part of Ansible but rather using an external function? If it were a core part of either the ansible-core or ansible packages then it would be installed, however, it doesn't seem to be so?

Or, am I missing something and this is a core part of the build?

[vreitech]

As it described at https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html filter's page: _Hash types available depend on the control system running Ansible, ‘hash’ depends on hashlib, passwordhash depends on passlib. The crypt is used as a fallback if passlib is not installed. Form this point python3-passlib doesn't looks like a mandatory core component. And at same time we are getting wrong BCrypt hash value without passlib (i. e. using crypt library).

[willhallonline]

So, are you suggesting that we leave it without, or is there a convincing argument that it should be included?

[vreitech]

Complicated. Used google a bit to find some information about "ansible password_hash bcrypt". And all that i got was people either had error message about crypt.crypt not supports bcrypt algorithm or had some kinds of errors after passlib package/module has been installed. Btw didn't got any information about someone got correct bcrypt hash not using passlib, but didn't even tried to find info about it tbf. At same time adding python3-passlib package "switches" password_hash Ansible module to using passlib which probably would broke people playbooks behavior (don't believe in that tbh). I suggest it should not be included into current images, but probably should be added into images which based on future Ansible versions. Or maybe it should be versions of images with passlib for each Linux distribution. Another way to handle the problem is to add installation of passlib python module through ansible.builtin.pip module. I've tested it on your images, and beginning from 2.12 version it works on all Linux distributions. Only one argument still for adding the package into the container: it fixes the issue without having to add something like apt-get -y update && apt-get -y install python3-passlib by user. Counter-arguments was above. Personally for me the problem is solved, thanks for questions.

[willhallonline]

From what I understand, I will leave as is at the moment. But if needed in the future I might re-open it. Thanks for your explanations. 😸