密码到底怎么存放才安全?

ansible-vault create secret.yml

ansible-vault encrypt existing_file.yml

ansible-vault decrypt secret.yml

ansible-vault edit secret.yml

ansible-vault rekey secret.yml

ansible-playbook playbook.yml --ask-vault-pass

ansible-playbook playbook.yml --vault-password-file .vault_pass

ansible-playbook playbook.yml --vault-id dev@prompt --vault-id prod@.prod_vault_pass

---
- hosts: all
  vars_files:
    - secret.yml
  tasks:
    - debug: var=my_secret_var

DB_USERNAME=walter
DB_PASSWORD=P@ss1234

DB_USERNAME=QUl4RTZxYzZLb2RlbDVGOA==
DB_PASSWORD=MDNXWDBaTVpxem4wOGpRUw==

AES_KEY: helloworld
AES_IV: 1234567890123456

DB_USER: walter
DB_PWD: P@ss1234

ansible-vault encrypt secrets.yml

DB_USERNAME={{ secrets.DB_USER }}
DB_PASSWORD={{ secrets.DB_PWD }}

variables:
  VAULT_PWD_FILE: .ansible_vault_password.txt
stages:
  - build
  - test
  - archive

job_build:
  stage: build
  script:
    - echo "check config file"
    - echo "$SECRET_KEY" > $VAULT_PWD_FILE
    - virtualenv -p python3 venv
    - . ./venv/bin/activate
    - pip install -r ./requirements.txt
    - ansible-playbook -v -i inventory.ini playbook.yml --vault-password-file $VAULT_PWD_FILE
    - rm -f $VAULT_PWD_FILE

- hosts: webserver
  become: true
  gather_facts: false
  tasks:

    - name: Load encrypted variables
      include_vars:
        file: secrets.yml
        name: vault_secrets

    - name: install dependencies
      shell: pip3 install -r requirements.txt
      delegate_to: localhost
      become: false

    - name: encrypt password
      shell: python3 aes_util.py {{ vault_secrets | to_json | b64encode }} {{ serial_number }}
      delegate_to: localhost
      become: false
      register: json_output

    - name: Parse the JSON output
      set_fact:
        secrets: "{{ json_output.stdout | from_json }}"
      when: json_output.stdout | from_json is not string

    - name: generate  .env
      template:
        src: ./etc/env.j2
        dest: "./etc/.env"
        owner: walter
        group: walter
        mode: '0644'

pycryptodome==3.20.0
ansible==2.16.6]

from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
from Crypto.Util.Padding import pad, unpad
import base64
import sys
import json

"""encrypt or decrypt by AES CBC

It uses Padding (PKCS #7), this padding scheme adds a series of bytes, all with the same value,
to make the length of the data a multiple of the block size.

The value of each added byte is the number of bytes that are added.

For example, if the block size is 16 bytes and the data needs 3 more bytes to reach this size,
it will add three bytes, each with the value 3 (0x03 0x03 0x03).

- Unpadding (PKCS #7):

During decryption, the padding is removed by reading the value of the last byte,
which indicates how many bytes were added, and then removing that many bytes.

Raises:
    TypeError: invalid key length
    TypeError: invalid iv length

Returns:
    _type_: instance
"""
class AESCipher:
    def __init__(self, key, iv):
        key_len = len(key)
        iv_len = len(iv)

        if key_len != 16 and key_len != 24 and key_len != 32:
            raise TypeError("Expect key length as 16, 24 or 32")
        if iv_len != 16:
            raise TypeError("Expect iv length as 16")

        self._key = key.encode('utf-8')
        self._iv = iv.encode('utf-8')

    def encrypt(self, raw):
        #print(f"raw bytes: {raw}")
        raw = pad(raw.encode('utf-8'), AES.block_size)
        cipher = AES.new(self._key, AES.MODE_CBC, self._iv)
        encrypted = cipher.encrypt(raw)
        return base64.b64encode(encrypted).decode('utf-8')

    def decrypt(self, enc):
        enc = base64.b64decode(enc)
        cipher = AES.new(self._key, AES.MODE_CBC, self._iv)
        #print(f"encrypted bytes: {enc}")
        raw = cipher.decrypt(enc)
        #print(f"decrypted bytes: {raw}")
        decrypted = unpad(raw, AES.block_size)
        #print(f"unpad bytes: {decrypted}")
        return decrypted.decode('utf-8')

def encrypt_pwd(json_obj, serial_number):
    aes_key = json_obj.get("AES_KEY")
    aes_iv = f"hb_{serial_number}"[0:16]

    for key, value in json_obj.items():
        cipher = AESCipher(aes_key, aes_iv)
        encrypted_text = cipher.encrypt(str(value))
        json_obj[key] = encrypted_text
    return json_obj

if __name__ == "__main__":

    if len(sys.argv) == 2:
        serial_number = sys.argv[1]
        content = ""
        with open('secrets.txt', 'r') as file:
            for line in file:
                content += line
        json_str = base64.b64decode(content).decode('utf-8')
        json_obj = json.loads(json_str)
        cipher_dict = encrypt_pwd(json_obj, serial_number)
        print(json.dumps(cipher_dict))
    elif len(sys.argv) == 3:
        json_arg = sys.argv[1]
        serial_number = sys.argv[2]
        json_str = base64.b64decode(json_arg).decode('utf-8')
        #print(f"json_str: {json_str}")
        json_obj = json.loads(json_str)
        cipher_dict = encrypt_pwd(json_obj, serial_number)
        print(json.dumps(cipher_dict))
    else:
        print("no arguments")
        exit(1)