# Help: FAILED! =\> {"msg": "Timeout (12s) waiting for privilege escalation prompt: "} **URL:** \ **Category:** Ansible Project\ **Created:** [July 30, 2018, 4:18pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198 "2018-07-30T16:18:44Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [July 30, 2018, 4:18pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/1 "2018-07-30T16:18:44Z")
Hi Ansible Gurus, I’m trying to automate some of my manual tasks on a VM. As part of that my VM doesn’t have direct root access. So I’ve to use a different user and then escalate to root. When I try to switch to root user, the password prompt is different than the default prompt. The prompt I see is as shown below ---
**Author:** ![Patrick\_Hunt](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@Patrick\_Hunt](https://forum.ansible.com/u/Patrick_Hunt)\ **Post date:** [July 30, 2018, 4:49pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/2 "2018-07-30T16:49:04Z")
> Ramu, I’m not sure how you are executing the playbook. There are flags that are required to prompt for privilege escalation credentials. The flag “–ask-become-pass” or “-K” will provide a prompt for entering the su password. For example, when I run certain playbooks I run `ansible-playbook path/to/some/playbook.yml -Kku username` This is -K : su password -k : ssh password -u : user to connect as The privilege escalation will not pick up the variable you have written into your playbook and use that to escalate. I hope this helps clear this up some. ---
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [July 31, 2018, 1:57pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/3 "2018-07-31T13:57:08Z")
Hi Patrick, Thanks for the kind response. I’m passing the su password in my playbook itself using the vars ansible\_become\_pass: “r00t” And I tried the option of passing it using -K. Thanks, Ramu ---
**Author:** ![Patrick\_Hunt](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@Patrick\_Hunt](https://forum.ansible.com/u/Patrick_Hunt)\ **Post date:** [July 31, 2018, 4:12pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/4 "2018-07-31T16:12:26Z")
> > Ramu, Are you able to run the following ad-hoc ansible command (replacing “” with the actual username) `ansible vm-1 -m ping -kKu -b --become-method=su --become-user=root` This should prompt you for the SSH password and then the SU password. You should get output similar to below: `vm-1 | SUCCESS => { "changed": false, "ping": "pong" }` This is a simple way that I am able to check connections and privilege escalation. If this succeeds we may need to look at how you launch the playbook, or perhaps a closer look at the playbook itself. Let me know, Thanks! ---
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [July 31, 2018, 5:08pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/5 "2018-07-31T17:08:15Z")
Hi Patrick, Once again thanks for the response. I tried that and it failed with the same error. Here is the output: ---
**Author:** ![Patrick\_Hunt](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@Patrick\_Hunt](https://forum.ansible.com/u/Patrick_Hunt)\ **Post date:** [July 31, 2018, 5:53pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/6 "2018-07-31T17:53:42Z")
Hmmm… Ok, so I’m getting stumped here. Reading back on your original post; are you able to become the root user manually (not using ansible, but logging in via SSH with the user and then running su - root)? You may need to correct permissions on the server before being able to escalate privileges with Ansible. Is the user part of the wheel group? Thanks, Patrick ---
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [July 31, 2018, 7:09pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/7 "2018-07-31T19:09:04Z")
Hi Patrick, Yes. I’m able to login manually and become root. Below is the output. ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [July 31, 2018, 7:23pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/8 "2018-07-31T19:23:29Z")
Here you are logged in as user1, but in this previous example you are using the user rdb    root@ubuntu:/var/tmp/# ansible vm-1 -m ping -kKu rdb -b --become-method=su --become-user=root    SSH password:    SU password[defaults to SSH password]:    oam2 | FAILED! =\> {      "msg": "Timeout (12s) waiting for privilege escalation prompt: "    } Ref the "-u rdb" in the above command. You would need to login with the same user, rdb, to check if you can do su with that user. If that works you need to add -vvvv to you ansible command so that Ansible output connection information. ---
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [July 31, 2018, 9:23pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/9 "2018-07-31T21:23:50Z")
Kai, Yes. I logged in with correct user. But it’s copy paste error. Here is the verbose output. \<1.2.3.4\> (0, ‘ansible-tmp-1533072148.28-279979573550115=/home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115\n’, ‘OpenSSH\_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 19: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_client\_request\_alive: done pid = 15640\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n’) Using module file /usr/lib/python2.7/dist-packages/ansible/modules/system/ping.py \<1.2.3.4\> PUT /root/.ansible/tmp/ansible-local-15625S\_C9qw/tmpLOijTW TO /home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115/ping.py \<1.2.3.4\> SSH: EXEC sshpass -d12 sftp -o BatchMode=no -b - -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o User=rdb -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/de671cab3f ‘[1.2.3.4]’ \<1.2.3.4\> (0, ‘sftp\> put /root/.ansible/tmp/ansible-local-15625S\_C9qw/tmpLOijTW /home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115/ping.py\n’, ‘OpenSSH\_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 19: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_client\_request\_alive: done pid = 15640\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug2: Remote version: 3\r\ndebug2: Server supports extension “[posix-rename@openssh.com](mailto:posix-rename@openssh.com)” revision 1\r\ndebug2: Server supports extension “[statvfs@openssh.com](mailto:statvfs@openssh.com)” revision 2\r\ndebug2: Server supports extension “[fstatvfs@openssh.com](mailto:fstatvfs@openssh.com)” revision 2\r\ndebug2: Server supports extension “[hardlink@openssh.com](mailto:hardlink@openssh.com)” revision 1\r\ndebug2: Server supports extension “[fsync@openssh.com](mailto:fsync@openssh.com)” revision 1\r\ndebug3: Sent message fd 5 T:16 I:1\r\ndebug3: SSH\_FXP\_REALPATH . → /home/rdb size 0\r\ndebug3: Looking up /root/.ansible/tmp/ansible-local-15625S\_C9qw/tmpLOijTW\r\ndebug3: Sent message fd 5 T:17 I:2\r\ndebug3: Received stat reply T:101 I:2\r\ndebug1: Couldn't stat remote file: No such file or directory\r\ndebug3: Sent message SSH2\_FXP\_OPEN I:3 P:/home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115/ping.py\r\ndebug3: Sent message SSH2\_FXP\_WRITE I:4 O:0 S:32768\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: In write loop, ack for 4 32768 bytes at 0\r\ndebug3: Sent message SSH2\_FXP\_WRITE I:5 O:32768 S:32768\r\ndebug3: Sent message SSH2\_FXP\_WRITE I:6 O:65536 S:302\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: In write loop, ack for 5 32768 bytes at 32768\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: In write loop, ack for 6 302 bytes at 65536\r\ndebug3: Sent message SSH2\_FXP\_CLOSE I:4\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n’) \<1.2.3.4\> ESTABLISH SSH CONNECTION FOR USER: rdb \<1.2.3.4\> SSH: EXEC sshpass -d12 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o User=rdb -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ControlPath=/root/.ansible/cp/de671cab3f 1.2.3.4 ‘/bin/sh -c ‘"’“‘chmod u+x /home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115/ /home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115/ping.py && sleep 0’”’“‘’ \<1.2.3.4\> (0, ‘’, ‘OpenSSH\_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 19: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_client\_request\_alive: done pid = 15640\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n’) \<1.2.3.4\> ESTABLISH SSH CONNECTION FOR USER: rdb \<1.2.3.4\> SSH: EXEC sshpass -d12 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o User=rdb -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ControlPath=/root/.ansible/cp/de671cab3f -tt 1.2.3.4 '/bin/sh -c '”‘“'su root -c '”’“'”‘"’“'”‘"’“'/bin/sh -c '”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘“‘echo BECOME-SUCCESS-uoqicabaewvrilicfbsweoportlzqwse; /usr/bin/python /home/rdb/.ansible/tmp/ansible-tmp-1533072148.28-279979573550115/ping.py’”’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“‘’”‘"’“'”‘"’“'”‘"’ && sleep 0’“'”‘’ oam2 | FAILED! =\> { ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [August 1, 2018, 8:57pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/10 "2018-08-01T20:57:25Z")
Unfortunately it didn't give any more information. Sshpass just look for "assword:" do determine when it should provide the password for ssh. I thought that Ansible did that for su prompt as well, but I was wrong after looking at source code. It has support for a bunch of languages but the prompt need to be "\'s password" or "password" for English and it's case insensitive. So your prompt "Enter login password:" will not work. There is no way of configuring this, but patching Ansible to make it work isn't hard, but then you would need to maintain your own Ansible version. ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [August 1, 2018, 9:15pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/11 "2018-08-01T21:15:20Z")
Correction, the strings must be "\'s password: " or "password: ". ---
**Author:** ![Badraj\_Angirekula](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@Badraj\_Angirekula](https://forum.ansible.com/u/Badraj_Angirekula)\ **Post date:** [August 2, 2018, 7:54am UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/12 "2018-08-02T07:54:40Z")
Hi all I am facing error in aws please help. [root@server2 ~]# ssh -i bhadra.pem ec2-user@ec2-50-112-6-190.us-west-2.compute. [amazonaws.com](http://amazonaws.com) The authenticity of host ‘[ec2-50-112-6-190.us-west-2.compute.amazonaws.com](http://ec2-50-112-6-190.us-west-2.compute.amazonaws.com) (50.1 12.6.190)’ can’t be established. ECDSA key fingerprint is 1f:1b:6b:13:d2:7a:b5:a4:4b:78:84:b7:98:05:ab:39. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added ‘[ec2-50-112-6-190.us-west-2.compute.amazonaws.com](http://ec2-50-112-6-190.us-west-2.compute.amazonaws.com),50. 112.6.190’ (ECDSA) to the list of known hosts. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for ‘bhadra.pem’ are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. bad permissions: ignore key: bhadra.pem Permission denied (publickey,gssapi-keyex,gssapi-with-mic). ---
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [August 2, 2018, 9:16pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/13 "2018-08-02T21:16:51Z")
Thanks Kai. Yes, It looks the file " play\_context.py" has hardcoded the prompt to contain something from the below list # TODO: needs to be configurable b\_SU\_PROMPT\_LOCALIZATIONS = [ to\_bytes(‘Password’), to\_bytes(‘암호’), to\_bytes(‘パスワード’), to\_bytes(‘Adgangskode’), to\_bytes(‘Contraseña’), to\_bytes(‘Contrasenya’), to\_bytes(‘Hasło’), to\_bytes(‘Heslo’), to\_bytes(‘Jelszó’), to\_bytes(‘Lösenord’), to\_bytes(‘Mật khẩu’), to\_bytes(‘Mot de passe’), to\_bytes(‘Parola’), to\_bytes(‘Parool’), to\_bytes(‘Pasahitza’), to\_bytes(‘Passord’), to\_bytes(‘Passwort’), to\_bytes(‘Salasana’), to\_bytes(‘Sandi’), to\_bytes(‘Senha’), to\_bytes(‘Wachtwoord’), to\_bytes(‘ססמה’), to\_bytes(‘Лозинка’), to\_bytes(‘Парола’), to\_bytes(‘Пароль’), to\_bytes(‘गुप्तशब्द’), to\_bytes(‘शब्दकूट’), to\_bytes(‘సంకేతపదము’), to\_bytes(‘හස්පදය’), to\_bytes(‘密码’), to\_bytes(‘密碼’), to\_bytes(‘口令’), ] This leaves the flexibility of customization. Rather the ansible should provide an option to specify the custom prompt messages. If we see there is a TODO note in the code. May be we need to raise this as an issue to ansible team. Thanks, Ramu ---
**Author:** ![Ramu](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Ramu](https://forum.ansible.com/u/Ramu)\ **Post date:** [August 2, 2018, 9:19pm UTC](https://forum.ansible.com/t/help-failed-msg-timeout-12s-waiting-for-privilege-escalation-prompt/28198/14 "2018-08-02T21:19:30Z")
Hi Badra, To your question, the ssh key permission should be 600. In your case you set it as 644. Please change it to 600 using : chmod 0600 bhadra.pem And try running the play. Also please change the subject. regards, Ramu