Repository: ansible/ansible

Issue:
ansible-vault create/encrypt: no password confirmation
##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
ansible-vault

##### ANSIBLE VERSION
```
ansible 2.2.1.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
```

##### CONFIGURATION
Default configuration

##### OS / ENVIRONMENT
CentOS release 6.7 (Final)

##### SUMMARY
``ansible-vault encrypt/create`` actions do not ask for password confirmation. 

As with these actions, new vault passwords are chosen, a password confirmation dialogue seems recommended. Otherwise it is too easy to mistype the password and lose the file contents.

Note that in previous versions this seems to have been supported (see e.g. https://www.digitalocean.com/community/tutorials/how-to-use-vault-to-protect-sensitive-ansible-data-on-ubuntu-16-04). Therefore I am filing this as a bug.

##### STEPS TO REPRODUCE
```
$ ansible-vault create vault.yml
Vault password: 
```

```
$ ansible-vault encrypt test
Vault password:
Encryption successful
```

```
$ ansible-vault rekey test
Vault password: 
New Vault password: 
Confirm New Vault password:
```

##### EXPECTED RESULTS
Also for "create" and "encrypt" actions, password confirmation is expected, since a new vault password is created.

##### ACTUAL RESULTS
Password confirmation only happens for rekey actions.




Discussion:
I can't reproduce with devel/stable-2.2/v2.2.1.0-1 

2.2.1.0-1
```
[fedora-25:ansible (stable-2.2 % u=)]$ git checkout-tag v2.2.1.0-1 
Switched to a new branch 'v2.2.1.0-1-branch'
[fedora-25:ansible (v2.2.1.0-1-branch %)]$ ansible --version
ansible 2.2.1.0 (v2.2.1.0-1-branch 5362910000) last updated 2017/03/09 09:41:07 (GMT -400)
  lib/ansible/modules/core:  not found - use git submodule update --init lib/ansible/modules/core
  lib/ansible/modules/extras:  not found - use git submodule update --init lib/ansible/modules/extras
  config file = /home/adrian/.ansible.cfg
  configured module search path = Default w/o overrides
[fedora-25:ansible (v2.2.1.0-1-branch %)]$ rm -rf testfoo.txt; echo 'foo' > testfoo.txt; ansible-vault encrypt testfoo.txt
Vault password: 
Encryption successful
[fedora-25:ansible (v2.2.1.0-1-branch %)]$ git log -1
commit 53629100006d1d8eebe3447235f8b4bf048a3dc0
Author: James Cammarata <jimi@sngx.net>
Date:   Mon Jan 16 10:13:31 2017 -0600

    New release v2.2.1.0-1
```

stable-2.2
```
[fedora-25:ansible (devel % u=)]$ git checkout stable-2.2
Switched to branch 'stable-2.2'
Your branch is up-to-date with 'origin/stable-2.2'.
[fedora-25:ansible (stable-2.2 % u=)]$ ansible --version
ansible 2.2.2.0 (stable-2.2 b33c41dc5f) last updated 2017/03/09 09:28:39 (GMT -400)
  lib/ansible/modules/core:  not found - use git submodule update --init lib/ansible/modules/core
  lib/ansible/modules/extras:  not found - use git submodule update --init lib/ansible/modules/extras
  config file = /home/adrian/.ansible.cfg
  configured module search path = Default w/o overrides
[fedora-25:ansible (stable-2.2 % u=)]$ rm -rf testfoo.txt; echo 'foo' > testfoo.txt; ansible-vault encrypt testfoo.txt
Vault password: 
Encryption successful
[fedora-25:ansible (stable-2.2 % u=)]$ cat testfoo.txt 
$ANSIBLE_VAULT;1.1;AES256
37646636626264663131663861633835373038346264636666663663306337656539363135373134
3133613739653766346261323432623466383861376336610a393432653639376334306533353961
31623361313261353536363235633863383430646665396163323561333533643766313131393963
3134626636623062330a313533343537326535366131323063386131643636663864386463633662
3031
```

devel

```
[fedora-25:ansible (devel % u=)]$ ansible --version
ansible 2.3.0 (devel 654e95ea49) last updated 2017/03/09 09:22:26 (GMT -400)
  config file = /home/adrian/.ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, Jan 12 2017, 17:59:37) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]
[fedora-25:ansible (devel % u=)]$ rm -rf testfoo.txt; echo 'foo' > testfoo.txt; ansible-vault encrypt testfoo.txt
Vault password: 
Encryption successful
[fedora-25:ansible (devel % u=)]$ cat testfoo.txt 
$ANSIBLE_VAULT;1.1;AES256
34333539356263393633663932386234313966316464383738343164313733653330613666323565
6639303239613931623462323737376262396265303636620a383139353432613836646236623139
64663532653763353839656465303237343131666631393362623064333766643861636636376130
3365623938333663650a633435363962396565303632636231633837643437656533663734636565
3032
```

Are the env variables ANSIBLE_VAULT_PASSWORD_FILE or ANSIBLE_ASK_VAULT_PASS set?

is vault_password_file or ask_vault_pass set in an ansible config file?

If ran with 'ansible-vault -vvv encrypt test', the path to the currently used config file should be shown.
I believe the report is that you are only prompted once, instead of prompt and confirm prompt.

Some actions use the double prompt, others a single.
> Are the env variables ANSIBLE_VAULT_PASSWORD_FILE or ANSIBLE_ASK_VAULT_PASS set?

No

> I believe the report is that you are only prompted once, instead of prompt and confirm prompt.

Exactly. Only rekey uses double prompt, while create/encrypt do not. Would like to see them for create/encrypt as well, as this essentially is also setting new passwords.

hmm, 32971e86396012af3eb88bbaa7f7b1c2cc27dee5 / 32971e86396012af3eb88bbaa7f7b1c2cc27dee5 did change this behavior between 2.2.0.0 and 2.2.1.0
That commit was to fix https://github.com/ansible/ansible/issues/18247 so the change on confirm wasnt intentional.

Resolving patch:
diff --git a/lib/ansible/cli/vault.py b/lib/ansible/cli/vault.py
--- a/lib/ansible/cli/vault.py
+++ b/lib/ansible/cli/vault.py
@@ -133,7 +133,12 @@ def run(self):
             self.b_new_vault_pass = CLI.read_vault_password_file(self.options.new_vault_password_file, loader)
 
         if not self.b_vault_pass or self.options.ask_vault_pass:
-            self.b_vault_pass = self.ask_vault_passwords()
+            # the 'read' options dont need to ask for password confirmation.
+            # 'edit' is read/write, but the decrypt will confirm.
+            if self.action in ['decrypt', 'edit', 'view', 'rekey']:
+                self.b_vault_pass = self.ask_vault_passwords()
+            else:
+                self.b_vault_pass = self.ask_new_vault_passwords()
 
         if not self.b_vault_pass:
             raise AnsibleOptionsError("A password is required to use Ansible's Vault")


Test patch: