# I can access ansible\_ssh\_pass but not ansible\_become\_pass? **URL:** \ **Category:** Ansible Developer\ **Created:** [November 18, 2018, 10:44pm UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059 "2018-11-18T22:44:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Lloyd\_Parkes](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@Lloyd\_Parkes](https://forum.ansible.com/u/Lloyd_Parkes)\ **Post date:** [November 18, 2018, 10:44pm UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/1 "2018-11-18T22:44:49Z")
Hi all, I have a playbook that needs a number of passwords. Two of the passwords are specific to the user running the playbook and so I would like to use the -K and -k command line options to ansible-playbook to allow the user to enter their passwords. My problem is that while I can use the variable ansible\_ssh\_pass to supply the -k password wherever it is needed in the playbook, the variable ansible\_become\_pass never seems to get defined. Can anyone explain why I have an ansible\_ssh\_pass, but not an ansible\_become\_pass variable and where the code is that does this? My test playbook is ` - hosts: localhost gather\_facts: no tasks: - debug: var=ansible\_ssh\_pass - debug: var=ansible\_become\_pass ` and the output is (manually copied) ` ok: [localhost] =\> { “ansible\_ssh\_pass”: “foo” } ok: [localhost] =\> { “ansible\_become\_pass”: “VARIABLE IS NOT DEFINED!” } ` Thanks, Lloyd ---
**Author:** ![Lloyd\_Parkes](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@Lloyd\_Parkes](https://forum.ansible.com/u/Lloyd_Parkes)\ **Post date:** [November 21, 2018, 7:44pm UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/2 "2018-11-21T19:44:53Z")
Found it. The problem is caused by commit [https://github.com/ansible/ansible/commit/078ebb0dec17675dbb0aaf9d656d2c0042988d46](https://github.com/ansible/ansible/commit/078ebb0dec17675dbb0aaf9d656d2c0042988d46) which strips far too many variables from the vars list being re-injected into the current context. As far as I can tell, only become\_user needs to stripped from the re-injected variables. Unfortunately, the commit doesn’t say which piece of code gets confused by the re-injection of of the become\_user variables, so all I can do at the moment is make sure that the test case from the original PR still gets fixed. Cheers, Lloyd ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [November 23, 2018, 10:16pm UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/3 "2018-11-23T22:16:48Z")
I would actually remove ansible\_pass/ansible\_ssh\_password to avoid accidental disclosures. Why do you need this information in the play? ---
**Author:** ![Lloyd\_Parkes](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@Lloyd\_Parkes](https://forum.ansible.com/u/Lloyd_Parkes)\ **Post date:** [November 24, 2018, 3:51am UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/4 "2018-11-24T03:51:18Z")
> I would actually remove ansible\_pass/ansible\_ssh\_password to avoid > accidental disclosures. Yeah, I know but… > Why do you need this information in the play? Not all modules authenticate the same way. In particular, I’m using the vmware\_guest module at the moment. There are many ways to skin this cat, but just making use of the second password that can be typed in on the command line involves a lot less friction. Cheers. Lloyd ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [November 26, 2018, 10:35pm UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/5 "2018-11-26T22:35:40Z")
or use vars\_prompt to get those kind of passwords? ---
**Author:** ![Lloyd\_Parkes](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@Lloyd\_Parkes](https://forum.ansible.com/u/Lloyd_Parkes)\ **Post date:** [November 27, 2018, 7:48am UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/6 "2018-11-27T07:48:25Z")
It comes in pints^Wprompts? I’m getting one. The code is still broken in that the re-injection filtering is too aggressive for its stated purpose. Also, the original-original commit (75b6f61) left some code detritus around in the form of RESET\_VARS which is a variable that is assigned to but no longer ever read from (AFAICT). Of course the tilde expansion code that gets bent out of shape over become\_user probably shouldn’t do that, but I think I found that source code a couple of years ago and I’m not surprised that nobody is in a hurry to poke at it. I have read the variables documentation quite often, and it never mentions this. vars\_prompt only seems to be mentioned in the “Playbooks: Special Topics” page and it would be nice if the Playbooks / Variables page listed all the ways that variables can be specified in a playbook. It only has to note that vars\_prompt is a special topic and move on. I’ll try and create github issues for these so that they can be recorded in excruciating detail for posterity, if nothing else. Cheers ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [November 28, 2018, 7:52pm UTC](https://forum.ansible.com/t/i-can-access-ansible-ssh-pass-but-not-ansible-become-pass/29059/7 "2018-11-28T19:52:47Z")
it really has it's own section [https://docs.ansible.com/ansible/latest/user\_guide/playbooks\_prompts.html](https://docs.ansible.com/ansible/latest/user_guide/playbooks_prompts.html)