# Ansible password\_hash issue

**URL:** <https://forum.ansible.com/t/ansible-password-hash-issue/32428>\
**Category:** Ansible Project\
**Created:** [March 10, 2020, 12:20pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428 "2020-03-10T12:20:59Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 10, 2020, 12:20pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/1 "2020-03-10T12:20:59Z")

</div>

Hi Everyone,

I’m trying to create a task for below command but it’s not working, can you help me how to make it work please?

Command:

```auto
update users set crypted_password = '$2a$12$uCkkXmhW5ThVK8mpBvnXOOJRLd64LJeHTeCkSuB3lfaR2N0AYBaSi', salt=null, hash_method='BCRYPT' where login = 'admin'

```

```auto
- name: Reset Admin pw
  become: yes
  become_user: postgres
  command: psql -c "update users set crypted_password = '{{ admin_password | password_hash('bcrypt') }}' where login = 'admin'" sonarqube
  tags: query

```

I’m successfully running the task but not able to login with the admin\_password.

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [March 10, 2020, 2:12pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/2 "2020-03-10T14:12:56Z")

</div>

You manual command has more arguments than the one in your task.  
Try making that consistent.

If that doesn't work, try hardcoding the hash in your task to see if  
that works at all.

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 10, 2020, 4:12pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/3 "2020-03-10T16:12:16Z")

</div>

Hi,

Thanks for the reply. By hard coding the hash working fine.

I’m trying to workout something like this but this is giving me an error.

```auto
- name: Reset Admin pw
  become: yes
  become_user: postgres
  command: psql -c "update users set crypted_password = '{{ admin_password | password_hash('bcrypt', salt=None) }}' where login = 'admin'" sonarqube
  tags: query

```

---

<div class="post-metadata">

**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\
**Post date:** [March 10, 2020, 6:32pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/4 "2020-03-10T18:32:03Z")

</div>

What is the error and what is sending the error? (i.e. is the error from “psql” or from Ansible itself?)

Can you run the playbook with “-vvv” and paste in the errors the “Reset Admin pw” step produces.

---

<div class="post-metadata">

**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\
**Post date:** [March 10, 2020, 7:22pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/5 "2020-03-10T19:22:26Z")

</div>

> Hi Everyone,
> 
> I'm trying to create a task for below command but it's not working, can you help me how to make it work please?
> 
> Command:
> 
> \>update users set crypted\_password = '$2a$12$uCkkXmhW5ThVK8mpBvnXOOJRLd64LJeHTeCkSuB3lfaR2N0AYBaSi', salt=null,  
> hash\_method='BCRYPT' where login = 'admin'|
> 
> - name: Reset Admin pw become: yes become\_user: postgres command: psql -c "update users set crypted\_password = '{{  
> admin\_password | password\_hash('bcrypt') }}' where login = 'admin'" sonarqube tags: query

Hello Bala,

please make sure that you have Python's passlib installed.

I tested that with Ansible 2.9.4 and without passlib the output was literally "\*0" ☹

Regards  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Racke

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 12, 2020, 11:12am UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/6 "2020-03-12T11:12:51Z")

</div>

Hi,

I manged to run the task successfully but i’m not able to login with the password to Sonarqube UI.

ansible 2.7.7  
config file = /etc/ansible/ansible.cfg  
configured module search path = [‘/root/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’]  
ansible python module location = /usr/lib/python3/dist-packages/ansible  
executable location = /usr/bin/ansible  
python version = 3.7.3 (default, Dec 20 2019, 18:57:59) [GCC 8.3.0]

```auto
- name: Reset Admin pw
  become: yes
  become_user: postgres
  command: command: psql -c "update users set crypted_password = '{{ admin_password | password_hash('bcrypt', salt=None) }}' where login = 'admin'" sonarqube
  tags: query

```

I noticed the Ansible encrypted the password : '$2b$12$QEsYuib1i6RO6fngZP4tzuUQvJMEo7k2jA48P.dVwwT5UE2fmygM.

But it seems to be UI login only works with $2a$10$ggLrB/SKx901ctz13V1OIOu2UJzApbdfFCR5KJ6X6GbH9VNAzqglO.

Is it possible to force Anisble to encrypt the password as $2a$10$ggLrB/SKx901ctz13V1OIOu2UJzApbdfFCR5KJ6X6GbH9VNAzqglO ?

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [March 12, 2020, 12:15pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/7 "2020-03-12T12:15:04Z")

</div>

Hi

Your hardcoded hash (the one "UI login only works") appears to use 10  
rounds, while the hash generated by password\_hash uses 12 (the  
default).  
Based on the docs at  
[https://passlib.readthedocs.io/en/stable/lib/passlib.hash.bcrypt.html#interface](https://passlib.readthedocs.io/en/stable/lib/passlib.hash.bcrypt.html#interface)  
you should be able to configure that as an argument for password\_hash,  
like:

{{ admin\_password | password\_hash('bcrypt', salt=None, rounds=10) }}

Not sure if this will fix your problem though, but worth trying.

On a related note, you are deliberately not using a salt. That is  
insecure, so if possible try to fix your workflow so that a salt is  
used.  
Your users will be thankful for it later.

Dick

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 12, 2020, 2:51pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/8 "2020-03-12T14:51:56Z")

</div>

Hi,

I’ve tried the rounds but no luck,still not able to login to UI.

About the salt option, it’s Sonarqube application which doesn’t use salt.

This is the command used on Sonarqube doc - [https://docs.sonarqube.org/latest/instance-administration/security/](https://docs.sonarqube.org/latest/instance-administration/security/)

```auto
update users set crypted_password = '$2a$12$uCkkXmhW5ThVK8mpBvnXOOJRLd64LJeHTeCkSuB3lfaR2N0AYBaSi', salt=null, hash_method='BCRYPT' where login = 'admin'

```

Thanks

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [March 12, 2020, 6:12pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/9 "2020-03-12T18:12:18Z")

</div>

The hardcoded admin hash uses the 2a version of bcrypt.  
It may be that your application cannot handle the newer 2b variant of  
bcrypt - which ansible creates.  
But this sounds unlikely.

Can you try to create a password with ansible using a salt (so leaving  
the "salt=None" out) ?

Dick

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 13, 2020, 11:38am UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/10 "2020-03-13T11:38:30Z")

</div>

I’ve deleted the salt option altogether but tit didn’t work.

Yeah, it’s the app which doesn’t like 2b variant.

Thanks

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [March 13, 2020, 11:58am UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/11 "2020-03-13T11:58:12Z")

</div>

Ansible's password\_hash doesn't support setting the 'ident' option,  
but if you want to test anyway, try editing passlib itself and change:

default\_ident = IDENT\_2A

into:

default\_ident = IDENT\_2B

This should be in handlers/bcrypt.py

If that does work for you, then you might want to submit a feature  
request to support this option.

Dick

---

<div class="post-metadata">

**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\
**Post date:** [March 13, 2020, 12:01pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/12 "2020-03-13T12:01:03Z")

</div>

> I've deleted the salt option altogether but tit didn't work.
> 
> Yeah, it's the app which doesn't like 2b variant.
> 
> Thanks

Hello Bala,

according to Wikipedia $2b$ was introduced int February 2014. On which operating system / version do you  
run Sonarqube? What is your PostgreSQL version?

Regards  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Racke

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 13, 2020, 3:09pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/13 "2020-03-13T15:09:34Z")

</div>

Ok,thanks.

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 13, 2020, 3:13pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/14 "2020-03-13T15:13:01Z")

</div>

OS - Debian 10  
PostgreSQL - 11.7

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 13, 2020, 3:31pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/15 "2020-03-13T15:31:12Z")

</div>

I have changed the ident to 2A and it’s working fine.

command: psql -c “update users set crypted\_password = ‘{{ admin\_password | password\_hash(‘bcrypt’, salt=None, rounds=10) }}’ where login = ‘admin’” sonarqube

Thanks

---

<div class="post-metadata">

**Author:** ![Bala\_Mutyam](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Bala\_Mutyam](https://forum.ansible.com/u/Bala_Mutyam)\
**Post date:** [March 13, 2020, 3:40pm UTC](https://forum.ansible.com/t/ansible-password-hash-issue/32428/16 "2020-03-13T15:40:06Z")

</div>

Requested the feature - [https://github.com/ansible/ansible/issues/68214](https://github.com/ansible/ansible/issues/68214)