# Ansible doesn't appear to cache sudo auth for each task in a playbook... is this correct? **URL:** \ **Category:** Ansible Developer\ **Created:** [May 5, 2014, 3:25am UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155 "2014-05-05T03:25:20Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Bowen\_Denning](https://avatars.discourse-cdn.com/v4/letter/b/e36b37/32.png) [@Bowen\_Denning](https://forum.ansible.com/u/Bowen_Denning)\ **Post date:** [May 5, 2014, 3:25am UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155/1 "2014-05-05T03:25:20Z")
Hey all, I’m hoping to use Ansible playbooks to automate a few tasks on my home network. My problem is that I use 2FA for authentication on all of my servers (using Yubikey). I’m quite happy to use key-based authentication for logging on to the servers, but I’d like to still require a one-time-password (OTP) to be entered for running privileged commands with sudo. If I’m running commands with sudo on a server from the shell, sudo only prompts me the first time for a password / OTP value, after that it will be cached and I won’t need to enter it for subsequent commands. Ansible playbooks, from what I can see, are attempting to use the sudo password for every task, which won’t work because the OTP value can only be used once (by design). ---
**Author:** ![Bowen\_Denning](https://avatars.discourse-cdn.com/v4/letter/b/e36b37/32.png) [@Bowen\_Denning](https://forum.ansible.com/u/Bowen_Denning)\ **Post date:** [May 5, 2014, 4:48am UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155/2 "2014-05-05T04:48:52Z")
Looks like this problem has been previously discussed here: [https://github.com/ansible/ansible/issues/3969](https://github.com/ansible/ansible/issues/3969) The conclusion back in August 2013 was that there’s no support, and no plans to support, 2FA. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 5, 2014, 5:47pm UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155/3 "2014-05-05T17:47:39Z")
To be clear, this was 8 months ago. We’d be up for considering it – but not likely implementing it as a free feature request. –Michael ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 5, 2014, 5:59pm UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155/4 "2014-05-05T17:59:12Z")
(Translation – patches would be considered, etc) ---
**Author:** ![Bowen\_Denning](https://avatars.discourse-cdn.com/v4/letter/b/e36b37/32.png) [@Bowen\_Denning](https://forum.ansible.com/u/Bowen_Denning)\ **Post date:** [May 22, 2014, 2:54am UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155/5 "2014-05-22T02:54:20Z")
For anyone who stumbles across this thread in the future, and has the know how to address the problem, it looks like sudo is explicitly told not to cache credentials in the make\_sudo\_cmd under lib/utils/ **init**.py (it appends “sudo -k” which causes sudo’s cache to be flushed for every task). I can’t see why using the cache would be a security concern, so I suspect flushing the cache is there to make things easier programatically (sudo is always guaranteed to ask for password) but that’s just a guess. Removing the “sudo -k” hasn’t worked (that would have been far too easy) so I’ll have to investigate more closely when I have some spare time to try and better understand Ansible’s code. Having the ability to tell sudo to cache the password would be enough to allow Ansible to apply configuration to a single host that uses OTP for authentication, which is good enough for my purposes, but it obviously wouldn’t work when applying config across multiple hosts at the same time. Thanks for your response Michael, I’ll see if I can get something working. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 25, 2014, 9:29pm UTC](https://forum.ansible.com/t/ansible-doesnt-appear-to-cache-sudo-auth-for-each-task-in-a-playbook-is-this-correct/15155/6 "2014-05-25T21:29:34Z")
FYI - Some folks do consider the system caching sudo creds a security issue (whether or not that’s your opinion, we can’t cache by default). Making it configurable with appropriate warnings in ansible.cfg is ok.