# Anyone successfully use python to generate a password hash and pass it into a usable variable in a playbook? **URL:** \ **Category:** Ansible Project\ **Created:** [July 3, 2019, 2:36am UTC](https://forum.ansible.com/t/anyone-successfully-use-python-to-generate-a-password-hash-and-pass-it-into-a-usable-variable-in-a-playbook/30702 "2019-07-03T02:36:26Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Paul\_Shulz](https://avatars.discourse-cdn.com/v4/letter/p/8edcca/32.png) [@Paul\_Shulz](https://forum.ansible.com/u/Paul_Shulz)\ **Post date:** [July 3, 2019, 2:36am UTC](https://forum.ansible.com/t/anyone-successfully-use-python-to-generate-a-password-hash-and-pass-it-into-a-usable-variable-in-a-playbook/30702/1 "2019-07-03T02:36:26Z")
Wondering if anyone has tried this or is ansible just intentionally designed to to allow you to do it? Below is the normal output from creating a hash at the command line as an example of manually hashing a password. [root@ansiblehost ~]# python -c “from passlib.hash import sha512\_crypt; import getpass; print sha512\_crypt.encrypt(getpass.getpass())” Password: $6$rounds=656000$UoSnvgI/Fm7zVWSf$TIKHXTuCECLOy2EQiyvzQpx.X4bflE8le8FmUk7OLSEuIq9HoN0xnHnOWaUFm7x2MCEZsX0/WJ6FBuBc.Nfqi0 I have tried a couple different ways in Ansible 2.8.1 trying to pull in the stdout with register: variable\_name . Turns out the variable\_name data was corrupted/changed with varying numbers of asterisk and even sometimes : which the plays complained of. Tried it directly injecting the initial password variable to pass in without using getpass and using getpass with expect scripts. Just thought it would be nice when I went to do root password change to take the new password from an input prompt: , pass it into a hash that could be captured in a variable to set the password in the next task without having to do the copy paste stuff. I pasted what was of interest in the debug between the hashing task and the variable being used in the update root password task. No combination of quoting in this case would change the results. (different password in this case) “warnings”: [“The value {'stderr\_lines': , 'changed': True, 'end': '2 **19-7-2 9:48:53.428542', 'stdout': '$6$rounds=656$6ZlH** TWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgih**kvMlkE9o9np/', 'cmd': 'python -c \\'from passlib.hash import sha512\_crypt; print sha512\_crypt.encrypt(\“rootletmein\”)\\'', 'rc': , 'failed': False, 'stderr': '', 'delta': '::.578785', 'stdout\_lines': ['$6$rounds=656**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*$6ZlH **TWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgih** kvMlkE9o9np/'], 'start': '2**19-7-2 9:48:52.849757'} (type dict) in a string field was converted to u'{\\'stderr\_lines\\': [], \\'changed\\': True, \\'end\\': \\'219-7-2 9:48:53.428542\\', \\'stdout\\': \\'$6$rounds=656$6ZlHTWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgihkvMlkE9o9np/\\', \\'cmd\\': \\'python -c \\\\\\'from passlib.hash import sha512\_crypt; print sha512\_crypt.encrypt(\“rootletmein\”)\\\\\\'\\', \\'rc\\': , \\'failed\\': False, \\'stderr\\': \\'\\', \\'delta\\': \\'::.578785\\', \\'stdout\_lines\\': [\\'$6$rounds=656**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*$6ZlH **TWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgih** kvMlkE9o9np/\\'], \\'start\\': \\'2\*\*\*\*\*\*\*\*19-\*\*\*\*\*\*\*\*7-\*\*\*\*\*\*\*\*2 \*\*\*\*\*\*\*\*9:48:52.849757\\'}' (type string). If this does not look like what you expect, quote the entire value to ensure it does not change.”, “The input password appears not to have been hashed. The 'password' argument must be encrypted for this module to work properly.”], “failed”: true, “rc”: 1 The simple ansible task - name: Update local Linux Account Password user: name: “{{account\_being\_changed}}” update\_password: always password: “{{new\_account\_crypt\_pw}}” Thanks, Paul the nubie! ---
**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\ **Post date:** [July 3, 2019, 6:28pm UTC](https://forum.ansible.com/t/anyone-successfully-use-python-to-generate-a-password-hash-and-pass-it-into-a-usable-variable-in-a-playbook/30702/2 "2019-07-03T18:28:03Z")
Have you tried using the password module to generate a random passwd? [https://docs.ansible.com/ansible/latest/plugins/lookup/password.html](https://docs.ansible.com/ansible/latest/plugins/lookup/password.html) ---
**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\ **Post date:** [July 5, 2019, 1:02am UTC](https://forum.ansible.com/t/anyone-successfully-use-python-to-generate-a-password-hash-and-pass-it-into-a-usable-variable-in-a-playbook/30702/3 "2019-07-05T01:02:30Z")
Hello: > Wondering if anyone has tried this or is ansible just intentionally designed to to allow you to do it? > > Below is the normal output from creating a hash at the command line as an example of manually hashing a password. > > [root@ansiblehost ~]# python -c “from passlib.hash import sha512\_crypt; import getpass; print sha512\_crypt.encrypt(getpass.getpass())” > Password: > $6$rounds=656000$UoSnvgI/Fm7zVWSf$TIKHXTuCECLOy2EQiyvzQpx.X4bflE8le8FmUk7OLSEuIq9HoN0xnHnOWaUFm7x2MCEZsX0/WJ6FBuBc.Nfqi0 > > I have tried a couple different ways in Ansible 2.8.1 trying to pull in the stdout with register: variable\_name . > Turns out the variable\_name data was corrupted/changed with varying numbers of asterisk and even sometimes : which the plays complained of. > Tried it directly injecting the initial password variable to pass in without using getpass and using getpass with expect scripts. > Just thought it would be nice when I went to do root password change to take the new password from an input prompt: , pass it > into a hash that could be captured in a variable to set the password in the next task without having to do the copy paste stuff. > > I pasted what was of interest in the debug between the hashing task and the variable being used in the update root password task. > No combination of quoting in this case would change the results. > (different password in this case) > > “warnings”: [“The value {'stderr\_lines': , 'changed': True, 'end': '2 **19-7-2 9:48:53.428542', 'stdout': '$6$rounds=656$6ZlH** TWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgih**kvMlkE9o9np/', 'cmd': 'python -c \\'from passlib.hash import sha512\_crypt; print sha512\_crypt.encrypt(\“rootletmein\”)\\'', 'rc': , 'failed': False, 'stderr': '', 'delta': '::.578785', 'stdout\_lines': ['$6$rounds=656**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*$6ZlH **TWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgih** kvMlkE9o9np/'], 'start': '2**19-7-2 9:48:52.849757'} (type dict) in a string field was converted to u'{\\'stderr\_lines\\': [], \\'changed\\': True, \\'end\\': \\'219-7-2 9:48:53.428542\\', \\'stdout\\': \\'$6$rounds=656$6ZlHTWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgihkvMlkE9o9np/\\', \\'cmd\\': \\'python -c \\\\\\'from passlib.hash import sha512\_crypt; print sha512\_crypt.encrypt(\“rootletmein\”)\\\\\\'\\', \\'rc\\': , \\'failed\\': False, \\'stderr\\': \\'\\', \\'delta\\': \\'::.578785\\', \\'stdout\_lines\\': [\\'$6$rounds=656**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*$6ZlH **TWZkf7a12Zr$O9tjbJfH5Tu9O6xJVft/nsrLODJjj4Nts7AIA74.Z9L1XOK7lfoEvGaJHzbAuXxD.QAzgGgih** kvMlkE9o9np/\\'], \\'start\\': \\'2\*\*\*\*\*\*\*\*19-\*\*\*\*\*\*\*\*7-\*\*\*\*\*\*\*\*2 \*\*\*\*\*\*\*\*9:48:52.849757\\'}' (type string). If this does not look like what you expect, quote the entire value to ensure it does not change.”, “The input password appears not to have been hashed. The 'password' argument must be encrypted for this module to work properly.”], “failed”: true, “rc”: 1 > > The simple ansible task > > - name: Update local Linux Account Password > user: > name: “{{account\_being\_changed}}” > update\_password: always > password: “{{new\_account\_crypt\_pw}}” Why don’t you use something like this? - name: Update local Linux Account Password user: name: “{{account\_being\_changed}}” update\_password: always password: “{{ new\_account\_plaintext\_pw | password\_hash(‘sha512’)}}” Just make sure you define your new\_account\_plaintext\_pw variable. Optionally, you can also use python to generate your password (if you don’t like the suggested alternative): - name: Generar passwords local\_action: module: shell /usr/local/bin/mkcryptpass.sh {{ new\_account\_plaintext\_pw }} register: passwd - name: Update local Linux Account Password user: name: “{{ account\_being\_changed }}” update\_password: always password: “{{ passwd.stdout }}” /usr/local/bin/mkcryptpass.sh might look like this: #!/bin/bash PASSWD=“$1” salt=$(openssl rand -base64 12) # $6$ → SHA512 salt=“$6$${salt}” python -c “import crypt; print(crypt.crypt("$PASSWD","$salt"))” Hope that helps