mount: CIFS credentials are logged

[jeffmcutter]

SUMMARY

ansible.posix.mount logs CIFS credentials in job output and /var/log/messages

ISSUE TYPE

• Bug Report

COMPONENT NAME

mount

ANSIBLE VERSION

bash-4.4# ansible --version
ansible [core 2.15.4]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/runner/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.9/site-packages/ansible
  ansible collection location = /home/runner/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.9.16 (main, May 31 2023, 12:21:58) [GCC 8.5.0 20210514 (Red Hat 8.5.0-18)] (/usr/bin/python3.9)
  jinja version = 3.1.2
  libyaml = True

COLLECTION VERSION

bash-4.4# ansible-galaxy collection list ansible.posix

# /usr/share/ansible/collections/ansible_collections
Collection    Version
------------- -------
ansible.posix 1.5.4  

CONFIGURATION

bash-4.4# ansible-config dump --only-changed
CONFIG_FILE() = /etc/ansible/ansible.cfg
bash-4.4# 

OS / ENVIRONMENT

Red Hat Enterprise Linux release 8.8 (Ootpa)

STEPS TO REPRODUCE

---
- name: Mount a cifs share
  hosts: winserv01.localdomain.local
  gather_facts: false
  tasks:
    - name: Mount an SMB share
      vars:
        __user: "{{ (credentials | selectattr('host', 'match', inventory_hostname))[0].user }}"
        __pass: "{{ (credentials | selectattr('host', 'match', inventory_hostname))[0].pass }}"
      ansible.posix.mount:
        path: /mnt
        src: '//{{ inventory_hostname }}/MyShare'
        fstype: cifs
        opts: "rw,vers=3,file_mode=0600,dir_mode=0700,username={{ __user }},password={{ __pass }}"
        state: ephemeral
      delegate_to: sattower06.localdomain.local
      # no_log: true

...

EXPECTED RESULTS

Credentials not to be logged.

ACTUAL RESULTS

From /var/log/messages:

Sep 25 05:29:12 sattower06 platform-python[4371]: ansible-ansible.posix.mount Invoked with path=/mnt src=//winserv01.localdomain.local/MyShare fstype=cifs opts=rw,vers=3,file_mode=0600,dir_mode=0700,username=Administrator,password=redhat1! state=ephemeral boot=True dump=0 passno=0 backup=False fstab=None

From job output:

      "opts": "rw,vers=3,file_mode=0600,dir_mode=0700,username=Administrator,password=redhat1!",

[bcoca]

As a workaround use no_log: true on the task (i see that you do already, it's commented out, but still mentioning here for others).