# Can -K be avoided and user password be placed inside playbook?

**URL:** <https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585>\
**Category:** Get Help\
**Created:** [February 24, 2025, 9:22am UTC](https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585 "2025-02-24T09:22:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![eliassal](https://avatars.discourse-cdn.com/v4/letter/e/43a26b/32.png) [@eliassal](https://forum.ansible.com/u/eliassal)\
**Post date:** [February 24, 2025, 9:22am UTC](https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585/1 "2025-02-24T09:22:04Z")

</div>

I have avery basic playbook which adds 2 users to localhost. Running the playbook with -K works fine but I am trying to make it run by introducing the become variables inside the playbook but it is not working. I tried  
become\_password = “mypassword”, it did not help. Then I write teh password inside a file in a directory host\_vars in the root folder as you can see hereunder did not help neither.

 ![image](https://us1.discourse-cdn.com/ansible/original/2X/2/2533109a52670ad32ddb4aa4f12e21dcb7f9264b.png)

I always get an error of permission denied as playbook was not able to retrieve password or user as follows  
“msg”: “useradd: Permission denied.\nuseradd: cannot lock /etc/group; try again later.\n”, “name”: “testuser1”, “rc”: 10}

Thanks for your help

---

<div class="post-metadata">

**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\
**Post date:** [February 24, 2025, 12:02pm UTC](https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585/2 "2025-02-24T12:02:16Z")

</div>

The variable is called `ansible_become_password` and can be given to the playbook with `--extra-vars` or in `host_vars/`/`group_vars` files.

(I’ll skip the warning about how much of a bad idea it is to put passwords somewhere in clear text and how Vault could be used, yadda yadda.)

---

<div class="post-metadata">

**Author:** ![eliassal](https://avatars.discourse-cdn.com/v4/letter/e/43a26b/32.png) [@eliassal](https://forum.ansible.com/u/eliassal)\
**Post date:** [February 24, 2025, 2:15pm UTC](https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585/3 "2025-02-24T14:15:43Z")

</div>

Sorry jpmens, this is a test environment and trying different ways.

I changed to ansible\_become\_password in the file but it is not recognized. Reverted back to naming it become\_password and creating localhost file in host\_vars with only 1 line with the password but it did not help

Both ansible\_become\_password and become\_password are not recognized in the playbook

---

<div class="post-metadata">

**Author:** ![kristianheljas](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kristianheljas/32/7702_2.png) [@kristianheljas](https://forum.ansible.com/u/kristianheljas)\
**Post date:** [February 24, 2025, 2:42pm UTC](https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585/4 "2025-02-24T14:42:45Z")

</div>

You are `become_user: salam`, effectively becoming `salam`.

Modifying users require root privileges.

If you remove `become_user` or set it to `root` you should be golden.

See [https://docs.ansible.com/ansible/latest/playbook\_guide/playbooks\_privilege\_escalation.html#become-directives](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#become-directives)

---

<div class="post-metadata">

**Author:** ![eliassal](https://avatars.discourse-cdn.com/v4/letter/e/43a26b/32.png) [@eliassal](https://forum.ansible.com/u/eliassal)\
**Post date:** [February 25, 2025, 1:53pm UTC](https://forum.ansible.com/t/can-k-be-avoided-and-user-password-be-placed-inside-playbook/40585/5 "2025-02-25T13:53:20Z")

</div>

Correct, it was my misunderstanding. I thought I should give a sudoer use name.  
Thanks for your help