# random grub password **URL:** \ **Category:** Ansible Project\ **Created:** [March 30, 2023, 8:55am UTC](https://forum.ansible.com/t/random-grub-password/37829 "2023-03-30T08:55:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Kathy\_L](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kathy_l/32/2652_2.png) [@Kathy\_L](https://forum.ansible.com/u/Kathy_L)\ **Post date:** [March 30, 2023, 8:55am UTC](https://forum.ansible.com/t/random-grub-password/37829/1 "2023-03-30T08:55:41Z")
I currently have a task that adds a grub password so if the user wants to change anything in grub they have to enter the proper user and password. The problem is that I have it working only when I generate the password by hand using grub-mkpasswd-pbkdf2 enter the password twice, which generates the hash. I then paste the hash into the variable “grub\_password”. The problem is I want to generate a random grub password on the fly and pass this password to grub-mkpasswd-pbkdf2 to generate the hash, then put the hash into a variable. I cannot figure out how to do this. Do I have to use the expect module to feed the random generated password into grub-mkpasswd-pdkdf2? I’ve scoured online but everyone seems to have generated the hash beforehand. Any ideas how I can do this? ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [March 31, 2023, 9:33am UTC](https://forum.ansible.com/t/random-grub-password/37829/2 "2023-03-31T09:33:54Z")
Actually, it's not that easy. I had previously created a filter to generate PBKDF2 hashes for the "mosquitto" application. Based on that I made a grub\_mkpasswd\_pbkdf2 filter: [https://gist.github.com/dnmvisser/c567608193ad6bc1465b182e9a58bca7](https://gist.github.com/dnmvisser/c567608193ad6bc1465b182e9a58bca7) Example on how to use it: dick.visser@foobar ~$ ansible -i localhost, all -m debug -a msg="{{ 'hackme' | grub\_mkpasswd\_pbkdf2 }}" localhost | SUCCESS =\> {     "msg": "grub.pbkdf2.sha512.10000.380BF76393CDE1AB16ACE9F32AE6DB262FDD43021FEEEC1A94B87F14640F6D09D3D7DA61977BB7A4384766697148758D061E84FD5F81745EDDFF4E4B6C7DB0D0.92DC5B05FED969DB16BC4982B8B23B8B575D12E2ED776A911D7D47901DC5DDD8B4BAD65C535C33900321D050B8BE9BC2A6C3EDF96C1FB0825A0DC54BBBEB2F5B" } ---
**Author:** ![Kathy\_L](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kathy_l/32/2652_2.png) [@Kathy\_L](https://forum.ansible.com/u/Kathy_L)\ **Post date:** [April 12, 2023, 9:52am UTC](https://forum.ansible.com/t/random-grub-password/37829/3 "2023-04-12T09:52:16Z")
That is pretty cool. Mgmt is not thrilled with using a filter and want me to see if I can do it another way. I’m trying using the expect module, but not getting the response I thought: - name: Use expect expect: command: /usr/bin/grub-mkpasswd-pbkdf2 responses: (?i)Enter password: “{{ random\_plaintext\_password }}” (?i)Reenter password: {{ random\_plaintext\_password }}" register: grub\_hash delegate\_to: 127.0.0.1 - name: Print grub\_hash debug: msg: “Grub hash is {{ grub\_hash.stdout }}” However this prints the entire “exchange”: New grub hash is Enter password: Reenter password: PDKDF2 hash of your password is… Why is the entire exchange printed out? I expected that the last line above would be printed which I could then use cut on to print only the password. ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [April 16, 2023, 6:28pm UTC](https://forum.ansible.com/t/random-grub-password/37829/4 "2023-04-16T18:28:48Z")
The .stdout contains everything that is printed to stdout, hence the name. You have .stdout\_lines where each lines is an element in the list, so grub\_hash.stdout\_lines[-1] gives you the last line. So what you are looking for is this    {{ grub\_hash.stdout\_lines[-1].split()[-1] }} ---
**Author:** ![Kathy\_L](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kathy_l/32/2652_2.png) [@Kathy\_L](https://forum.ansible.com/u/Kathy_L)\ **Post date:** [April 18, 2023, 2:36pm UTC](https://forum.ansible.com/t/random-grub-password/37829/5 "2023-04-18T14:36:14Z")
Thanks for that. Guess I need to learn more about the stdout options ---
**Author:** ![mzagrabe](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@mzagrabe](https://forum.ansible.com/u/mzagrabe)\ **Post date:** [April 18, 2023, 2:42pm UTC](https://forum.ansible.com/t/random-grub-password/37829/6 "2023-04-18T14:42:19Z")
> I currently have a task that adds a grub password so if the user wants to change anything in grub they have to enter the proper user and password. > > The problem is that I have it working only when I generate the password by hand using grub-mkpasswd-pbkdf2 enter the password twice, which generates the hash. I then paste the hash into the variable “grub\_password”. > > The problem is I want to generate a random grub password on the fly and pass this password to grub-mkpasswd-pbkdf2 to generate the hash, then put the hash into a variable. I cannot figure out how to do this. Do I have to use the expect module to feed the random generated password into grub-mkpasswd-pdkdf2? I’d stay away from expect. > I’ve scoured online but everyone seems to have generated the hash beforehand. Any ideas how I can do this? Here is some python code that is completely unverified: [https://github.com/ryran/burg2-mkpasswd-pbkdf2](https://github.com/ryran/burg2-mkpasswd-pbkdf2) I just recently did this in puppet (ruby based): def default\_grub\_mkpasswd\_pbkdf2( clear\_text, salt, rounds = 10000 ) require ‘openssl’ digest = OpenSSL::Digest::SHA512.new hashed\_password = OpenSSL::PKCS5.pbkdf2\_hmac(clear\_text, salt, rounds, digest.digest\_length, digest).unpack(‘H\*’).first.upcase return “grub.pbkdf2.sha512.#{rounds}.#{salt.unpack(‘H\*’).first.upcase}.#{hashed\_password}” end I know that is a ruby, but it shouldn’t be hard to translate. If you pass it the same salt each time, you’ll get the same hash each time. That is, it is deterministic. Cheers, -m