Project: KICS (Provisioning / Security & Compliance)
File: c6473dae-8477-4119-88b7-b909b435ce7b.md

title: Logging of Sensitive Data hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c6473dae-8477-4119-88b7-b909b435ce7b Query name: Logging of Sensitive Data Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: To keep sensitive values out of logs, tasks that expose them need to be marked defining 'no_log' and setting to True<br> ```cfg title="Positive test num. 1 - cfg file" hl_lines="1" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory factcachingprefix=ansible_facts factcachingtimeout=86400 collectionsonansibleversionmismatch=warning collections_path=~/.ansible/collections:/usr/share/ansible/collections collectionsscansys_path=True command_warnings=False action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action allowunsafelookups=False ask_pass=False askvaultpass=False cache_plugins=~/.ansible/plugins/cache:/usr/share/ansible/plugins/cache callback_plugins=~/.ansible/plugins/callback:/usr/share/ansible/plugins/callback cliconf_plugins=~/.ansible/plugins/cliconf:/usr/share/ansible/plugins/cliconf connection_plugins=~/.ansible/plugins/connection:/usr/share/ansible/plugins/connection debug=False executable=/bin/sh filter_plugins=~/.ansible/plugins/filter:/usr/share/ansible/plugins/filter force_handlers=False forks=5 gathering=implicit gather_subset=all lookup_plugins=~/.ansible/plugins/lookup:/usr/share/ansible/plugins/lookup ansible_managed=Ansible managed modulecompression=ZIPDEFLATED module_name=command library=~/.ansible/plugins/modules:/usr/share/ansible/plugins/modules moduleutils=~/.ansible/plugins/moduleutils:/usr/share/ansible/plugins/module_utils netconf_plugins=~/.ansible/plugins/netconf:/usr/share/ansible/plugins/netconf ``` ```cfg title="Positive test num. 2 - cfg file" hl_lines="39" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory factcachingprefix=ansible_facts factcachingtimeout=86400 collectionsonansibleversionmismatch=warning collections_path=~/.ansible/collections:/usr/share/ansible/collections collectionsscansys_path=True command_warnings=False action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action allowunsafelookups=False ask_pass=False askvaultpass=False cache_plugins=~/.ansible/plugins/cache:/usr/share/ansible/plugins/cache callback_plugins=~/.ansible/plugins/callback:/usr/share/ansible/plugins/callback cliconf_plugins=~/.ansible/plugins/cliconf:/usr/share/ansible/plugins/cliconf connection_plugins=~/.ansible/plugins/connection:/usr/share/ansible/plugins/connection debug=False executable=/bin/sh filter_plugins=~/.ansible/plugins/filter:/usr/share/ansible/plugins/filter force_handlers=False forks=5 gathering=implicit gather_subset=all lookup_plugins=~/.ansible/plugins/lookup:/usr/share/ansible/plugins/lookup ansible_managed=Ansible managed modulecompression=ZIPDEFLATED module_name=command library=~/.ansible/plugins/modules:/usr/share/ansible/plugins/modules moduleutils=~/.ansible/plugins/moduleutils:/usr/share/ansible/plugins/module_utils netconf_plugins=~/.ansible/plugins/netconf:/usr/share/ansible/plugins/netconf no_log=False ``` ```cfg title="Negative test num. 1 - cfg file" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory factcachingprefix=ansible_facts factcachingtimeout=86400 collectionsonansibleversionmismatch=warning collections_path=~/.ansible/collections:/usr/share/ansible/collections collectionsscansys_path=True command_warnings=False action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action allowunsafelookups=False ask_pass=False askvaultpass=False cache_plugins=~/.ansible/plugins/cache:/usr/share/ansible/plugins/cache callback_plugins=~/.ansible/plugins/callback:/usr/share/ansible/plugins/callback cliconf_plugins=~/.ansible/plugins/cliconf:/usr/share/ansible/plugins/cliconf connection_plugins=~/.ansible/plugins/connection:/usr/share/ansible/plugins/connection debug=False executable=/bin/sh filter_plugins=~/.ansible/plugins/filter:/usr/share/ansible/plugins/filter force_handlers=False forks=5 gathering=implicit gather_subset=all lookup_plugins=~/.ansible/plugins/lookup:/usr/share/ansible/plugins/lookup ansible_managed=Ansible managed modulecompression=ZIPDEFLATED module_name=command library=~/.ansible/plugins/modules:/usr/share/ansible/plugins/modules moduleutils=~/.ansible/plugins/moduleutils:/usr/share/ansible/plugins/module_utils netconf_plugins=~/.ansible/plugins/netconf:/usr/share/ansible/plugins/netconf no_log=True ```