Search code examples
ansibleansible-inventory

the inventory (host) list in ansible is in /etc/ansible/; what is reasons to have it in /etc?


I am new to ansible and work on my setup. I see that the list of hosts is per default in /etc/anisble/hosts and changed with root privileges. In tutorials I have seen solutions with the host file in user space.

I would prefer to have all ansible setup under my home directory. What is the advantage of putting the hosts file in /etc respective the reason that the default location is there?

Thank you for clarification!


Solution

  • From a security perspective, putting it in the /etc directory is the safest initial option for a few reasons.

    If Ansible defaulted to using an inventory file in the 'current directory' the playbook is executed in, then it would be easy for a bad actor to place an inventory file in other commonly used directories that are accessed by multiple people (such as /tmp, /var/tmp, etc). If they succeeded in getting someone to execute a playbook in that directory, it could perform additional actions the user didn't expect.

    If Ansible default to using an inventory file in your home directory, this could open up that user to exploits by someone sending them a malicious email attachment or other method to write a file in their home directory that they weren't expecting.