Ansible passing sudo and ssh password without prompting

by Anish

---

Posted on Tuesday July 3rd

---

---

In this section we will learn how to pass ansible ssh and sudo password using the Ansible variable ansible_ssh_pass and ansible_become_pass

Ansible Privilege Escalation Options

In the Ansible Managed target Node, System Administrator has setup the ansible user password protected to perform SSH and become Sudo

[sudo] password for ansible:

Since Identity option is not setup when ansible ping fails

[ansible@controller ~]$ 
172.16.9.4 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", 
    "unreachable": true
}

---

Ansible Passing SSH Connection password

Pass the Connection options -k, --ask-pass ask for connection password

[ansible@controller ~]$ ansible -m ping all -k 
SSH password: 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Privilege Escalation Options:

Pass the Privilege options -K, --ask-become-pass for to become sudo user

[ansible@controller ~]$ ansible -m ping all -k -K
SSH password: 
SUDO password[defaults to SSH password]: 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Once the sshagent is setup for on the next ansible run connection password and priviledge escalaltion option is not required

 [ansible@controller ~]$ ansible -m ping all 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Use ansilbe-playbook to automate the both SSH and SUDO Password

Define the Ansible variable (Unsafe mode use Vault Instead to Protect passwords) in the group_vars/all.yml

• ansible_ssh_pass
• non sudoers users
• ansible_become_pass

[ansible@controller ~ ]$ cat group_vars/all.yml 
ansible_ssh_pass: ansible
ansible_become_pass: ansible

Define the ping tasks for the ansible playbook with become true

[ansible@controller opt]$ cat ping.yml 
---
- hosts: all
  gather_facts: false
  become: true
  tasks:
    - ping:

Run the Playbook

[ansible@controller ~ ]$ ansible-playbook ping.yml 
PLAY [all] *********************************************************************

TASK [ping] ********************************************************************
ok: [172.16.9.4]

PLAY RECAP *********************************************************************
172.16.9.4                 : ok=1    changed=0    unreachable=0    failed=0

---

Thanku for reading !!! Give a Share for Support

Asking for donation sound bad to me, so i'm raising fund from by offering all my Nine book for just $9

---

---