The strange part is that only some of the expected files get created (and owned by root), but the task appears to fail in the middle of iterating dictionary keys.
Since some files get created I assume 1) sudo password is correctly entered and 2) the task is run as root.
After running the playbook tally2 counts 14 failed logins for my account, though the sudo password should’ve
been correctly entered (since some files do get created as root).
Do you have more that one auth backend in PAM? like pam_unix + pam_ldap? Do those have different passwords? A fail in one doesn’t necessarily mean that login fails.
The explanation seems to be that pam_tally2 records a failed login when
login command is started, even before a password is entered. Normally, the
failed logins counter is reset when the user enters the correct password.
For login this works correctly when the following line is added in pam
config (common-auth):