Ansible passing sudo and ssh password without prompting

by Anish

Posted on Tuesday July 3rd

In this section we will learn how to pass ansible ssh and sudo password using the Ansible variable ansible_ssh_pass and ansible_become_pass

Ansible Privilege Escalation Options

In the Ansible Managed target Node, System Administrator has setup the ansible user password protected to perform SSH and become Sudo

[sudo] password for ansible:

Since Identity option is not setup when ansible ping fails

[ansible@controller ~]$ 
172.16.9.4 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", 
    "unreachable": true
}

Ansible Passing SSH Connection password

Pass the Connection options -k, --ask-pass ask for connection password

[ansible@controller ~]$ ansible -m ping all -k 
SSH password: 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Privilege Escalation Options:

Pass the Privilege options -K, --ask-become-pass for to become sudo user

[ansible@controller ~]$ ansible -m ping all -k -K
SSH password: 
SUDO password[defaults to SSH password]: 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Once the sshagent is setup for on the next ansible run connection password and priviledge escalaltion option is not required

 [ansible@controller ~]$ ansible -m ping all 
172.16.9.4 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

Use ansilbe-playbook to automate the both SSH and SUDO Password

Define the Ansible variable (Unsafe mode use Vault Instead to Protect passwords) in the group_vars/all.yml

• ansible_ssh_pass
• non sudoers users
• ansible_become_pass

[ansible@controller ~ ]$ cat group_vars/all.yml 
ansible_ssh_pass: ansible
ansible_become_pass: ansible

Define the ping tasks for the ansible playbook with become true

[ansible@controller opt]$ cat ping.yml 
---
- hosts: all
  gather_facts: false
  become: true
  tasks:
    - ping:

Run the Playbook

[ansible@controller ~ ]$ ansible-playbook ping.yml 
PLAY [all] *********************************************************************

TASK [ping] ********************************************************************
ok: [172.16.9.4]

PLAY RECAP *********************************************************************
172.16.9.4                 : ok=1    changed=0    unreachable=0    failed=0

Thanku for reading !!! Give a Share for Support

Your Support Matters!

Instead of directly asking for donations, I'm thrilled to offer you all nine of my books for just $9 on leanpub By grabbing this bundle you not only help cover my coffee, beer, and Amazon bills but also play a crucial role in advancing and refining this project. Your contribution is indispensable, and I'm genuinely grateful for your involvement in this journey!

Any private key value that you enter or we generate is not stored on this site, this tool is provided via an HTTPS URL to ensure that private keys cannot be stolen, for extra security run this software on your network, no cloud dependency