# Failing host (or better still - a group of hosts) after one login failure.

**URL:** <https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020>\
**Category:** Ansible Project\
**Created:** [October 13, 2020, 11:50am UTC](https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020 "2020-10-13T11:50:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Go\_Away](https://avatars.discourse-cdn.com/v4/letter/g/bc79bd/32.png) [@Go\_Away](https://forum.ansible.com/u/Go_Away)\
**Post date:** [October 13, 2020, 11:50am UTC](https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020/1 "2020-10-13T11:50:00Z")

</div>

I have (again ;-\>) a quite unusual situation.  
I have a bunch of hosts to which I connect with ansible to perform some tasks. The problem is that they are not mine alone and the authentication is done with password and is based on some central directory service. So I have a shared account for some servers and since the password gets aged-out, there may be a situation that my password stored in keepass is no longer valid.  
If I try to run a playbook against an inventory file consiting of some of the servers for which the password is no longer valid I end up locking myself out of the account. So is there a way to make ansible give up on a host (or even better - on a whole bunch of hosts sharing the same credentials) if I get even a single login failure?

Best regards,  
MK

---

<div class="post-metadata">

**Author:** ![Stu](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@Stu](https://forum.ansible.com/u/Stu)\
**Post date:** [October 13, 2020, 12:16pm UTC](https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020/2 "2020-10-13T12:16:53Z")

</div>

Can you not put an ssh key on the host?  
a single account can have multiple keys

---

<div class="post-metadata">

**Author:** ![Go\_Away](https://avatars.discourse-cdn.com/v4/letter/g/bc79bd/32.png) [@Go\_Away](https://forum.ansible.com/u/Go_Away)\
**Post date:** [October 13, 2020, 12:31pm UTC](https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020/3 "2020-10-13T12:31:41Z")

</div>

I know. I use key-based authentication widely but unfortunately, in this case, it’s not available for me. There are organization-wide password policies and so on so I’m stuck with rotating passwords.

---

<div class="post-metadata">

**Author:** ![Stu](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@Stu](https://forum.ansible.com/u/Stu)\
**Post date:** [October 13, 2020, 12:44pm UTC](https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020/4 "2020-10-13T12:44:04Z")

</div>

So a bit of error handling?

[https://docs.ansible.com/ansible/2.5/user\_guide/playbooks\_error\_handling.html](https://docs.ansible.com/ansible/2.5/user_guide/playbooks_error_handling.html)

so just do a simple command like echo a message with become before anything else in your play and if that fails register it as a failure and stop the play?

---

<div class="post-metadata">

**Author:** ![Go\_Away](https://avatars.discourse-cdn.com/v4/letter/g/bc79bd/32.png) [@Go\_Away](https://forum.ansible.com/u/Go_Away)\
**Post date:** [October 13, 2020, 12:50pm UTC](https://forum.ansible.com/t/failing-host-or-better-still-a-group-of-hosts-after-one-login-failure/34020/5 "2020-10-13T12:50:44Z")

</div>

Seems a good path. Will probably have to dig a bit deeper not to fail tasks for other servers for which I have another authentication scheme but at first glance seems a good idea.  
Thanks!