arista.avd.encrypt filter

[PHipnarowicz]

Hello AVD Developers,

Do you have any plans to extend filter with user type? This can be useful when setting "local_users" input variables, like:

local_users:
  - name: <str>
    sha512_password: "{{ text_password | arista.avd.encrypt(passwd_type='loca_user', hash_algorithm='sha512', key='') }}"

BR

[ClausHolbechArista]

No current plans, but it would be a good addition.

[gmuloc]

I agree with @ClausHolbechArista that we would want to add this to our current filters

there is a solution that some have used with builtin ansible filters password_hash if you want to unlock yourself for now:

sha512_password: "{{ clear_password | password_hash('sha512',  65534 | random(seed=inventory_hostname) | string) }}

[PHipnarowicz]

True, this is what I'm currently using, but according to below message I'm looking for another solution:

[DEPRECATION WARNING]: Encryption using the Python crypt module is deprecated. The Python crypt module is deprecated and will be removed from Python 3.13. Install the passlib library for continued encryption functionality. This feature will be removed in version 2.17.

ansible.builtin.password_hash with Python passlib produces sha512 secret:

$6$rounds=656000$AVD$6rhPa0ll51.ETfOXc2ICXYAYc0iVR9KQXC6HYAyVoO3TIFsjWx1oD5o0wu1SYLkB5kpDJfqqNbnky./lY7X2P.

but it is not acceptable by Arista EOS device:

veos-lab(config)#username admin_test privilege 15 role network-admin secret sha512 $6$rounds=656000$AVD$6rhPa0ll51.ETfOXc2ICXYAYc0iVR9KQXC6HYAyVoO3TIFsjWx1oD5o0wu1SYLkB5kpDJfqqNbnky./lY7X2P.
% Invalid input

So, if you would want to add "local_user" type to AVD encrypt filter, can you provide any timeframe?

[gmuloc]

ah yeah - so with passlib there is another trick let me find it (question of number of rounds ...)

sha512_password: "{{ clear_password | password_hash(rounds=5000) }}"

can you provide any timeframe?

difficult to provide a timeframe for now, this is not being worked on actively - maybe someone from the community will pick this up.

[PHipnarowicz]

Very good trick, thanks.