# "Incorrect sudo password" when trying to dynamically set ansible\_sudo\_pass

**URL:** <https://forum.ansible.com/t/incorrect-sudo-password-when-trying-to-dynamically-set-ansible-sudo-pass/16618>\
**Category:** Ansible Project\
**Created:** [October 27, 2014, 4:50pm UTC](https://forum.ansible.com/t/incorrect-sudo-password-when-trying-to-dynamically-set-ansible-sudo-pass/16618 "2014-10-27T16:50:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aaron\_Caskey](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@Aaron\_Caskey](https://forum.ansible.com/u/Aaron_Caskey)\
**Post date:** [October 27, 2014, 4:50pm UTC](https://forum.ansible.com/t/incorrect-sudo-password-when-trying-to-dynamically-set-ansible-sudo-pass/16618/1 "2014-10-27T16:50:20Z")

</div>

Hi. I am trying to set up an environment using different passwords for different hosts:

In ./group\_vars/all I have the line:

> > * * *
> > 
> > ansible\_sudo\_pass: “{{ lookup(‘password’, ‘passwords/’ + inventory\_hostname) }}”  
> > #ansible\_sudo\_pass:

(basically stolen from this page: [http://serverfault.com/questions/560106/how-can-i-implement-ansible-with-per-host-passwords-securely](http://serverfault.com/questions/560106/how-can-i-implement-ansible-with-per-host-passwords-securely))

And the corresponding password files exist.

My testing playbook is:

> > * * *
> > 
> > - hosts: all  
> > sudo: no  
> > tasks:
> > - name: Some name  
> > debug: msg=“!{{ ansible\_sudo\_pass }}!.”

It works with sudo set to “no” and outputs the correct password strings for each host.

If I set sudo to “yes” I get:

> fatal: [] =\> Incorrect sudo password

for each host

If I uncomment out the second line in group\_vars/all then it works (for the host with that password, which is all of them while I test)

What am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [October 30, 2014, 8:27pm UTC](https://forum.ansible.com/t/incorrect-sudo-password-when-trying-to-dynamically-set-ansible-sudo-pass/16618/2 "2014-10-30T20:27:11Z")

</div>

“If I uncomment out the second line in group\_vars/all then it works (for the host with that password, which is all of them while I test)”

(A)

If you have a variable in a file twice, the second one is going to win when it loads, because it’s a hash and there’s only room for one.

I suspect the second password is valid. Not to say anything about the first.

(B)

You can’t use the lookup plugins that early in the variable cycle, and probably are overcomplicating this bit some by doing so.