# alternate shadow file?

**URL:** <https://forum.ansible.com/t/alternate-shadow-file/29449>\
**Category:** Ansible Project\
**Created:** [January 16, 2019, 5:00pm UTC](https://forum.ansible.com/t/alternate-shadow-file/29449 "2019-01-16T17:00:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [January 16, 2019, 5:00pm UTC](https://forum.ansible.com/t/alternate-shadow-file/29449/1 "2019-01-16T17:00:19Z")

</div>

Greetings.

I would like to use the “user” module to change my password, but the shadow file is not located in /etc/shadow . It’s in an alternate location, specifically, /mnt/pxe/etc/shadow . Is there a way to accomplish this?

I have a bad feeling that the answer is “only if the underlying passwd command allows this option,” which it doesn’t.

I suppose the “lineinfile” module will accomplish this with a little bit of extra effort, but it would be nice if the standard “user” module would allow this.

Maybe somebody has a better idea?

Thanks.

–EbH

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 16, 2019, 11:12pm UTC](https://forum.ansible.com/t/alternate-shadow-file/29449/2 "2019-01-16T23:12:49Z")

</div>

use chroot to /mnt/pxe and then use user module, passwd will then  
'work as expected', with ansible this might mean using the 'chroot'  
connection plugin

---

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [January 17, 2019, 12:20pm UTC](https://forum.ansible.com/t/alternate-shadow-file/29449/3 "2019-01-17T12:20:18Z")

</div>

Unless the functionality has changed, it’s my understanding that ansible cannot use chroot when managing a remote machine.

---

<div class="post-metadata">

**Author:** ![hugonz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hugonz/32/503_2.png) [@hugonz](https://forum.ansible.com/u/hugonz)\
**Post date:** [January 17, 2019, 4:51pm UTC](https://forum.ansible.com/t/alternate-shadow-file/29449/4 "2019-01-17T16:51:36Z")

</div>

If there is a complete chroot environment under /mnt/pxe, you could configure a new ansible user to always log into a chrooted environment, using a sshd\_config file and these two lines:

Match User new\_ansible\_user  
ChrootDirectory /mnt/pxe

Then use ansible normally under that special user.

But that seems overkill, it would be easier to script the password change locally with mkpassword and some text manipulation.

---

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [January 22, 2019, 1:48pm UTC](https://forum.ansible.com/t/alternate-shadow-file/29449/5 "2019-01-22T13:48:40Z")

</div>

Thanks for the tip. Setting up a chroot-only ansible-only user is a pretty good idea.

In this particular case, after talking with a co-worker, I ended up simply copying one shadow file to the other (note that this is a redacted copy for informational purposes only)

tasks:

- name: “update system password”  
user:  
name: “{{ item }}”  
update\_password: always
- name: “update chroot password”  
copy:  
src: /etc/shadow  
remote\_src: yes  
dest: /mnt/pxe/etc/shadow  
notify: “rebuild image”