# encrypted password hash question

**URL:** <https://forum.ansible.com/t/encrypted-password-hash-question/34343>\
**Category:** Ansible Project\
**Created:** [December 16, 2020, 7:56pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343 "2020-12-16T19:56:25Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rene\_Paquin](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@Rene\_Paquin](https://forum.ansible.com/u/Rene_Paquin)\
**Post date:** [December 16, 2020, 7:56pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/1 "2020-12-16T19:56:25Z")

</div>

Hi. New ansible user here so just starting out. My first experiment is to create a user with sudo privileges on an Oracle Linux 8 server in my test environment. Here are the contents of the files in the /home/”user”/ansible/playbooks folder. I think I am missing something as when I run the playbook it runs successfully. I confirm that the account is created however when I attempt to ssh or login the attempt gets denied access.

Any help is appreciated.

Thank you,

**user\_pass.ym** l - encrypted using “ansible-vault create user\_pass.yml” in group\_vars folder

admin\_group: wheel

password: #G00d4now

**ansible.cfg**

[defaults]

inventory = ./inventory

remote\_user = (local user with authorized keys)

[privilege\_escalation]

become = true

become\_method = sudo

become\_user = root

**inventory**

[ol8]

qansibletest

---

<div class="post-metadata">

**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\
**Post date:** [December 17, 2020, 8:13am UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/2 "2020-12-17T08:13:32Z")

</div>

> Hi. New ansible user here so just starting out. My first experiment is to create a user with sudo privileges on an  
> Oracle Linux 8 server in my test environment. Here are the contents of the files in the /home/”user”/ansible/playbooks  
> folder. I think I am missing something as when I run the playbook it runs successfully. I confirm that the account is  
> created however when I attempt to ssh or login the attempt gets denied access.
> 
> Any help is appreciated.
> 
> Thank you,
> 
> \*user\_pass.ym\*l - encrypted using “ansible-vault create user\_pass.yml” in group\_vars folder
> 
> admin\_group: wheel
> 
> password: #G00d4now
> 
> \*ansible.cfg\*
> 
> [defaults]
> 
> inventory = ./inventory
> 
> remote\_user = (local user with authorized keys)
> 
> [privilege\_escalation]
> 
> become = true
> 
> become\_method = sudo
> 
> become\_user = root
> 
> \*inventory\*
> 
> [ol8]
> 
> qansibletest
> 
> \*create\_users.yml\*
> 
> - name: Create New Users
> 
> hosts: all
> 
> gather\_facts: false
> 
> tasks:
> 
> - name: Create User Task
> 
> ```
> user:
> 
> name: devops
> 
> state: present
> 
> password: &quot;\{\{ &#39;password&#39; | password\_hash\(&#39;sha512&#39;,&#39;A512&#39;\) \}\}&quot;
> 
> shell: /bin/bash
> 
> groups: &quot;\{\{ admin\_group \}\}&quot;
> 
> append: true
> 
> ```
> 
> ...

You are literally passing the string "passsword" instead of the value of the password  
variable. Remove the quotes from 'password',

Regards  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Racke

---

<div class="post-metadata">

**Author:** ![Rene\_Paquin](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@Rene\_Paquin](https://forum.ansible.com/u/Rene_Paquin)\
**Post date:** [December 17, 2020, 7:51pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/3 "2020-12-17T19:51:21Z")

</div>

Further to this..

I found that when using this statement in the playbook it is not grabbing the variable in the group\_vars/ol8 file but actually passing password as password despite the removal of quotes. Just wondering if I am missing to declare something?

password: "{{ password | password\_hash('sha512', 'A512') }}"

Rene

---

<div class="post-metadata">

**Author:** ![Joseph\_Alexander](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@Joseph\_Alexander](https://forum.ansible.com/u/Joseph_Alexander)\
**Post date:** [December 17, 2020, 8:04pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/4 "2020-12-17T20:04:44Z")

</div>

I always find that behavior gets tricky when using key words as variables. Try changing password to pwd or passwd.

---

<div class="post-metadata">

**Author:** ![Rene\_Paquin](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@Rene\_Paquin](https://forum.ansible.com/u/Rene_Paquin)\
**Post date:** [December 17, 2020, 8:25pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/5 "2020-12-17T20:25:20Z")

</div>

Thanks for the suggestion. This just leads to more….

When I use this

password: “{{ passwrd | password\_hash(‘sha512’, ‘A512’) }}” I get the following error:

TASK [Create Users Task] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

fatal: [qreneansible.wlu.ca]: FAILED! =\> {“msg”: “Unexpected templating type error occurred on ({{ passwd | password\_hash(‘sha512’, ‘A512’) }}): crypt() argument 1 must be str, not None”}

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

qreneansible.wlu.ca : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

It seems that it cannot find the variable anywhere. In the playbook file I did add the following but it still cant find it. The file is encrypted as well.

vars\_files:

- group\_vars/ol8

Thanks again,

Rene

---

<div class="post-metadata">

**Author:** ![Joseph\_Alexander](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@Joseph\_Alexander](https://forum.ansible.com/u/Joseph_Alexander)\
**Post date:** [December 17, 2020, 8:32pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/6 "2020-12-17T20:32:29Z")

</div>

and of course you also set the new passwrd variable? Its not null or empty?

---

<div class="post-metadata">

**Author:** ![Rene\_Paquin](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@Rene\_Paquin](https://forum.ansible.com/u/Rene_Paquin)\
**Post date:** [December 17, 2020, 8:37pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/7 "2020-12-17T20:37:00Z")

</div>

I did. The contents of the encrypted file are:

admin\_group: wheel

passwrd: #G00d4now

Rene

---

<div class="post-metadata">

**Author:** ![Joseph\_Alexander](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@Joseph\_Alexander](https://forum.ansible.com/u/Joseph_Alexander)\
**Post date:** [December 17, 2020, 8:43pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/8 "2020-12-17T20:43:29Z")

</div>

try removing the # from the password and see if that makes a difference

---

<div class="post-metadata">

**Author:** ![Rene\_Paquin](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@Rene\_Paquin](https://forum.ansible.com/u/Rene_Paquin)\
**Post date:** [December 18, 2020, 1:11pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/9 "2020-12-18T13:11:18Z")

</div>

That did the trick. Thank you very much.

Rene

---

<div class="post-metadata">

**Author:** ![Joseph\_Alexander](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@Joseph\_Alexander](https://forum.ansible.com/u/Joseph_Alexander)\
**Post date:** [December 18, 2020, 2:33pm UTC](https://forum.ansible.com/t/encrypted-password-hash-question/34343/10 "2020-12-18T14:33:19Z")

</div>

Great. So it was interpreting your password as a comment. Glad it worked.

Regards,

Joe.