# Ansible Privilege Escalation

**URL:** <https://forum.ansible.com/t/ansible-privilege-escalation/18769>\
**Category:** Ansible Project\
**Created:** [July 15, 2015, 10:38am UTC](https://forum.ansible.com/t/ansible-privilege-escalation/18769 "2015-07-15T10:38:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mona\_Gopal](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@Mona\_Gopal](https://forum.ansible.com/u/Mona_Gopal)\
**Post date:** [July 15, 2015, 10:38am UTC](https://forum.ansible.com/t/ansible-privilege-escalation/18769/1 "2015-07-15T10:38:51Z")

</div>

Hello Everyone,

Below is a play that i have written to execute the task as a sudo user.

- name: Testing the sudo user concept in this play  
hosts: all

# user: ved

become: yes  
become\_method: su  
become\_pass: root\_123

tasks:

- name: edits the contents of the file this task will execute only as a root user  
lineinfile: dest=/root/sample.txt state=present insertafter=‘EOF’ line=‘GAURAV’ regexp=‘MONA’

# become: yes

# become\_method: su

# become\_pass: root\_123

The problem :

The “become\_pass” does not work in case of a play , but works fine in case of a task.  
Could anyone help me out with this?  
Our task is to run the playbook on click of a button in GUI ,so we cannot go by the method of prompting for password.  
And also to mention we have multiple tasks to be executed and hence want to apply the become\_pass for a play and just a task(like i mentioned in case of a task it works fine.)

Thanks in advance,  
Mona G

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [July 18, 2015, 8:17pm UTC](https://forum.ansible.com/t/ansible-privilege-escalation/18769/2 "2015-07-18T20:17:05Z")

</div>

What version of ansible?

I just removed this in 2.0 as I thought it was an oversite (i cringed  
at passwords embedded in playbooks), but I will reconsider if a good  
case can be made for the feature.

---

<div class="post-metadata">

**Author:** ![Alex\_Leonhardt](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@Alex\_Leonhardt](https://forum.ansible.com/u/Alex_Leonhardt)\
**Post date:** [July 18, 2015, 10:14pm UTC](https://forum.ansible.com/t/ansible-privilege-escalation/18769/3 "2015-07-18T22:14:14Z")

</div>

Hi, you could use Vault instead of using plain text ROOT passwords … That’s extremely dangerous …

IMHO, there’s never a need to set it in a file, other than in Vault which is encrypted, of course 😉 … Just my thoughts.

Alex

---

<div class="post-metadata">

**Author:** ![Mona\_Gopal](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@Mona\_Gopal](https://forum.ansible.com/u/Mona_Gopal)\
**Post date:** [July 20, 2015, 4:00am UTC](https://forum.ansible.com/t/ansible-privilege-escalation/18769/4 "2015-07-20T04:00:44Z")

</div>

I’m currently using ansible 1.9.2