Ansible passing sudo and ssh password without prompting

by Anish


Posted on Tuesday July 3rd



In this section we will learn how to pass ansible ssh and sudo password using the Ansible variable ansible_ssh_pass and ansible_become_pass

Ansible Privilege Escalation Options

In the Ansible Managed target Node, System Administrator has setup the ansible user password protected to perform SSH and become Sudo

[sudo] password for ansible:

Since Identity option is not setup when ansible ping fails

[ansible@controller ~]$ 
172.16.9.4 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", 
    "unreachable": true
}

Ansible Passing SSH Connection password

Pass the Connection options -k, --ask-pass ask for connection password

[ansible@controller ~]$ ansible -m ping all -k 
SSH password: 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Privilege Escalation Options:

Pass the Privilege options -K, --ask-become-pass for to become sudo user

[ansible@controller ~]$ ansible -m ping all -k -K
SSH password: 
SUDO password[defaults to SSH password]: 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Once the sshagent is setup for on the next ansible run connection password and priviledge escalaltion option is not required

 [ansible@controller ~]$ ansible -m ping all 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Use ansilbe-playbook to automate the both SSH and SUDO Password

Define the Ansible variable (Unsafe mode use Vault Instead to Protect passwords) in the group_vars/all.yml

  • ansible_ssh_pass
  • non sudoers users
  • ansible_become_pass

[ansible@controller ~ ]$ cat group_vars/all.yml 
ansible_ssh_pass: ansible
ansible_become_pass: ansible

Define the ping tasks for the ansible playbook with become true

[ansible@controller opt]$ cat ping.yml 
---
- hosts: all
  gather_facts: false
  become: true
  tasks:
    - ping:

Run the Playbook

[ansible@controller ~ ]$ ansible-playbook ping.yml 
PLAY [all] *********************************************************************

TASK [ping] ********************************************************************
ok: [172.16.9.4]

PLAY RECAP *********************************************************************
172.16.9.4                 : ok=1    changed=0    unreachable=0    failed=0

Thanku for reading !!! Give a Share for Support

Asking for donation sound bad to me, so i'm raising fund from by offering all my Nine book for just $9



python Cryptography Topics
Topics
For Coffee/ Beer/ Amazon Bill and further development of the project Support by Purchasing, The Modern Cryptography CookBook for Just $9 Coupon Price

Kubernetes for DevOps

Hello Dockerfile

Cryptography for Python Developers

Cryptography for JavaScript Developers

Go lang ryptography for Developers

Here