# Sudo auth fails in the middle of playbook

**URL:** <https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095>\
**Category:** Ansible Project\
**Created:** [November 24, 2016, 5:50pm UTC](https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095 "2016-11-24T17:50:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![marko](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@marko](https://forum.ansible.com/u/marko)\
**Post date:** [November 24, 2016, 5:50pm UTC](https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095/1 "2016-11-24T17:50:56Z")

</div>

Hi,

I’m having weird problems where sudo authentication seems to fail in the middle of a playbook.

The playbook is run like this:

ansible-playbook … -b --ask-become-pass … myplaybook.yml

The playbook includes this bit that I’m using to reproduce an actual problem:

- name: test123  
command: touch /tmp/test/{{item.key}}  
with\_dict: “{{users | combine(ext\_users | default({})) }}”

When I run the playbook I get this error:

TASK [playbook1 : test123] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [foo.bar.baz]: FAILED! =\> {“failed”: true, “msg”: “ERROR! Incorrect sudo password”}

The strange part is that only some of the expected files get created (and owned by root), but the task appears to fail in the middle of iterating dictionary keys.  
Since some files get created I assume 1) sudo password is correctly entered and 2) the task is run as root.

Any ideas why this happens?

marko

---

<div class="post-metadata">

**Author:** ![marko](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@marko](https://forum.ansible.com/u/marko)\
**Post date:** [November 25, 2016, 8:08am UTC](https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095/2 "2016-11-25T08:08:17Z")

</div>

This seems to be related with our use of the pam\_tally2 module.  
I’ve the fillowing configuration:

`auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1200`

When I disable this the playbook gets executed without errors.

After running the playbook tally2 counts 14 failed logins for my account, though the sudo password should’ve

been correctly entered (since some files do get created as root).

---

<div class="post-metadata">

**Author:** ![Paul\_Totterman](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@Paul\_Totterman](https://forum.ansible.com/u/Paul_Totterman)\
**Post date:** [November 25, 2016, 9:24am UTC](https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095/3 "2016-11-25T09:24:27Z")

</div>

> After running the playbook tally2 counts 14 failed logins for my account, though the sudo password should’ve
> 
> been correctly entered (since some files do get created as root).

Do you have more that one auth backend in PAM? like pam\_unix + pam\_ldap? Do those have different passwords? A fail in one doesn’t necessarily mean that login fails.

Cheers,  
Paul

---

<div class="post-metadata">

**Author:** ![marko](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@marko](https://forum.ansible.com/u/marko)\
**Post date:** [November 25, 2016, 9:51am UTC](https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095/4 "2016-11-25T09:51:26Z")

</div>

I’m only using the pam\_unix authentication method.  
Apart from pam\_tally2 my pam config is just the default Ubuntu 16.04 config.

thanks,

marko

---

<div class="post-metadata">

**Author:** ![marko](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@marko](https://forum.ansible.com/u/marko)\
**Post date:** [December 1, 2016, 8:31am UTC](https://forum.ansible.com/t/sudo-auth-fails-in-the-middle-of-playbook/23095/5 "2016-12-01T08:31:15Z")

</div>

The explanation seems to be that pam\_tally2 records a failed login when  
login command is started, even before a password is entered. Normally, the  
failed logins counter is reset when the user enters the correct password.

For login this works correctly when the following line is added in pam  
config (common-auth):

auth required pam\_tally2.so file=/var/log/tallylog deny=5 even\_deny\_root  
unlock\_time=1200 serialize

However, when using sudo, the counter only gets reset when the following  
line is added to pam configuration (common-account):

account required pam\_tally2.so

So, the workaround is to add the above line in pam config.