# Correct way to generate and use per host user passwords + possible regression

**URL:** <https://forum.ansible.com/t/correct-way-to-generate-and-use-per-host-user-passwords-possible-regression/21110>\
**Category:** Ansible Project\
**Created:** [April 8, 2016, 3:27pm UTC](https://forum.ansible.com/t/correct-way-to-generate-and-use-per-host-user-passwords-possible-regression/21110 "2016-04-08T15:27:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Strauss](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Strauss](https://forum.ansible.com/u/David_Strauss)\
**Post date:** [April 8, 2016, 3:27pm UTC](https://forum.ansible.com/t/correct-way-to-generate-and-use-per-host-user-passwords-possible-regression/21110/1 "2016-04-08T15:27:31Z")

</div>

Good evening everyone, I’m looking for an automated way to create user accounts with random passwords and re-using them for the `ansible_sudo_pass` variable.

Is there an official position on how to do/accomplish this?  
My current solution broke after an update from Ansible 1.9 to Ansible 2 and I struggle to make it work under Ansible 2.

For more details let me explain my solution and how it breaks with Ansible 2.

I create a new user and store its password with this task:

```auto

---
- name: Create user
  user: name=deployer group=deployer password={{item}} state=present
  with_password: "./passwords/my-server/users/deployer encrypt=sha256_crypt"

In a different playbook I use the previously created user and its password like this:

```

---

<div class="post-metadata">

**Author:** ![pjdeelman](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@pjdeelman](https://forum.ansible.com/u/pjdeelman)\
**Post date:** [April 12, 2016, 11:05am UTC](https://forum.ansible.com/t/correct-way-to-generate-and-use-per-host-user-passwords-possible-regression/21110/2 "2016-04-12T11:05:27Z")

</div>

oppertunity to shameless plug my own lookup 😉  
But if you convert to password-store for storing and creating passwords you could use my lookup plugin which does all this. (except for the part of reencrypting it with sha256, just file an issue)

[https://github.com/morphje/ansible\_pass\_lookup](https://github.com/morphje/ansible_pass_lookup)

If you lookup a password with create=true in the lookup it will even create a new password for you. Tested with ansible 2.0

Kind regards,  
Patrick Deelman