ansible/ansible — pull request #5633 by Oneiroi (2014-01-15 16:00:20+00:00)
Title: Security enhancement support mysql hashes in place of plain text passwords.

To avoid having to use plaintext passwords in playbooks this adds support for instead passing the hash of the password which assuming the password is of sufficient complexity is far more secure than having the password in plaintext within the play books.

Tested with the following playbook:

```
---
- hosts: all
tasks:
- name: mysql_user test password hashed
mysql_user: user=test password=*973D12C21B4F274E09461F56EEAB92AB7B6FC20A priv=*.*:ALL,GRANT
- name: mysql_user test2 password not hashed
mysql_user: user=test2 password=ansible priv=*.*:ALL,GRANT
```

resulting hash in both cases is identical.

A loop is used in place of a regect pattern as in testing the loop was 20x faster than re.match (assuming I got the math right of course).

Note this only works for 5.x MySQL hashes, the old password hashes are not support (and should not be used at all frankly); this does not work for pluggable authentication introduced in 5.6 i.e. the sha256 plugin at this time (can't pass the raw hash -> plain text will continue to function normally).