Setting user password via ansible module user didn't work as expected

Archives Ansible Project
1

Hello,

I’m very new to ansible. So, please bare with me if I ask some beginners questions.

I try to set a user password using the ansible ad-hoc mode with the user-module. To generate the password has I use the python command mentioned in the FAQ here. Using the python command to generate a password hash produces a hash like this:

$6$rounds=100000$nu.kkTNOWqlbz.6T$JtYE/77zl9p...

This is a short version from the complete string. I try to set the password with the following command:

`
ansible localhost -m user -a “name=johnd password=‘$6$rounds=100000$nu.kkTNOWqlbz.6T$JtYE/77zl9p…’ state=present”

`

But when I lookup the has in /etc/shadow it looks like:

`

grep ‘johnd’ /etc/shadow
johnd:=100000$nu.kkTNOWqlbz.6T$JtYE/77zl9p:16976:0:99999:7:::

`

The following part of the hash string is missing:

`
$6$rounds=

`

And just now I figured out, that the python command generates a different has every time for the same password:

root@hostname>python -c "from passlib.hash import sha512_crypt; import getpass; print sha512_crypt.encrypt(getpass.getpass())" Password: $6$rounds=100000$GQDbqHk4Y1bcLF8t$PjC0r5o.B75.buNFvcOhSp2SdB4zRTfVlbrQ2u7aN5W9L5h1UqOaGMHAYtR.QvmcmUF2vLGSfAR30fYwcvvzJ. [2016.06.24 09:35:18] ~ root@hostname>python -c "from passlib.hash import sha512_crypt; import getpass; print sha512_crypt.encrypt(getpass.getpass())" Password: $6$rounds=100000$t57obQLCBDhu.0Hx$ffsDGXXLuAjCnl5Mv7wLoZuzcJqkw.wJ0NQn1/K9bP9hu4dH4gZmZQ0GXb.7lsBSmAOSeo26IJqNlGq90MALP0 [2016.06.24 09:35:27] ~ root@hostname>python -c "from passlib.hash import sha512_crypt; import getpass; print sha512_crypt.encrypt(getpass.getpass())" Password: $6$rounds=100000$yLMPFyCM2ZmftBaX$QP3uBV7WHUjrD2G0xO7VXIdILivE0Y1pgbLrlgRBicD3e7dRNSx1cCF1FEeOLzPLK.AuuSGVQESwpixlWj8o01 [2016.06.24 09:35:35] ~

Unfortunately there is no
`

`

mkpasswd --method=SHA-512

`

`
available on my red hat system.

Could you explain how I could generate a password hash to use with the ansible user module, please?

Kind regards,
Joerg K.

2

This is a short version from the complete string. I try to set the password
with the following command:
ansible localhost -m user -a "name=johnd
password='$6$rounds=100000$nu.kkTNOWqlbz.6T$JtYE/77zl9p...' state=present"

But when I lookup the has in /etc/shadow it looks like:

grep 'johnd' /etc/shadow

johnd:=100000$nu.kkTNOWqlbz.6T$JtYE/77zl9p:16976:0:99999:7:::

This is because shell expansion, the shell expand $6 and $rounds since it sees them as variables.

Swap your quotes and it should work.
ansible localhost -m user -a 'name=johnd password="$6$rounds=100000$nu.kkTNOWqlbz.6T$JtYE/77zl9p..." state=present'

And just now I figured out, that the python command generates a different
has every time for the same password:
root@hostname>python -c "from passlib.hash import sha512_crypt; import
getpass; print sha512_crypt.encrypt(getpass.getpass())"
Password:
$6$rounds=100000$GQDbqHk4Y1bcLF8t$PjC0r5o.B75.
buNFvcOhSp2SdB4zRTfVlbrQ2u7aN5W9L5h1UqOaGMHAYtR.QvmcmUF2vLGSfAR30fYwcvvzJ.
[2016.06.24 09:35:18] ~
root@hostname>python -c "from passlib.hash import sha512_crypt; import
getpass; print sha512_crypt.encrypt(getpass.getpass())"
Password:
$6$rounds=100000$t57obQLCBDhu.0Hx$ffsDGXXLuAjCnl5Mv7wLoZuzcJqkw.wJ0NQn1/
K9bP9hu4dH4gZmZQ0GXb.7lsBSmAOSeo26IJqNlGq90MALP0
[2016.06.24 09:35:27] ~
root@hostname>python -c "from passlib.hash import sha512_crypt; import
getpass; print sha512_crypt.encrypt(getpass.getpass())"
Password:
$6$rounds=100000
$yLMPFyCM2ZmftBaX$QP3uBV7WHUjrD2G0xO7VXIdILivE0Y1pgbLrlgRBicD3e7dRNSx1cCF1FEeOLzPLK
.AuuSGVQESwpixlWj8o01

Since you have not specified the salt in sha512_crypt.encrypt it makes a random one. This is the reason the hashes is different with the same password. The output format is $id$rounds$salt$hashed

3

Hi,

Sorry for my late reply. You are right. Changing the quotes solved my problem.

Thanks a lot,
Joerg