# trigger --ask-become-pass with playbook variable? **URL:** \ **Category:** Ansible Project\ **Created:** [February 21, 2024, 9:52am UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694 "2024-02-21T09:52:44Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [February 21, 2024, 9:52am UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/1 "2024-02-21T09:52:44Z")
Hii, I would like to have a playbook trigger the asking of the become password, but I couldn’t find how to do it. Is there perhaps some variable that can be set in a playbook (or play) to do this? I was thinking of something like “ask\_become\_pass: true” or something like that. thx Dick ---
**Author:** ![Stu](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@Stu](https://forum.ansible.com/u/Stu)\ **Post date:** [February 21, 2024, 10:50am UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/2 "2024-02-21T10:50:13Z")
Better to use ssh keys or store the details in ansible vault or something but if you need to prompt for the password you could potentially use vars\_prompt: ? something like - hosts: all become: yes vars\_prompt: - name: ansible\_become\_pass prompt: “Enter sudo password” private: yes tasks: - name: Install a package ansible.builtin.yum: name: vim state: present ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [February 21, 2024, 11:23am UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/3 "2024-02-21T11:23:39Z")
thx, this worked! ---
**Author:** ![Evan\_Hisey](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Evan\_Hisey](https://forum.ansible.com/u/Evan_Hisey)\ **Post date:** [February 21, 2024, 7:53pm UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/4 "2024-02-21T19:53:15Z")
Why not use the “-K” when launching ansible-playbook? That will trigger prompting fo the sudo password securely. ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [February 22, 2024, 1:28pm UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/5 "2024-02-22T13:28:07Z")
Because I don’t want to have to remember to use it. I have several playbooks, some of them require -K and some of them do not. I think it should be possible to express that requirement with some parameter, so that I don’t have to remember it. Is the above workaround less secure than doing -K on the command line? thx Dick ---
**Author:** ![Evan\_Hisey](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Evan\_Hisey](https://forum.ansible.com/u/Evan_Hisey)\ **Post date:** [February 22, 2024, 9:11pm UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/6 "2024-02-22T21:11:19Z")
Potentially, as far as I can tell the workaround does nothing to stop a plaintext log of the password in memory. You might also consider using ansible Vault, and the ansible\_become\_password variable. This seems more inline with what you need/want. Even allows for using different passwords in various points by changing the variable with set. [https://eengstrom.github.io/musings/ansible-sudo-var](https://eengstrom.github.io/musings/ansible-sudo-var) ---
**Author:** ![Stu](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@Stu](https://forum.ansible.com/u/Stu)\ **Post date:** [February 23, 2024, 9:31am UTC](https://forum.ansible.com/t/trigger-ask-become-pass-with-playbook-variable/38694/7 "2024-02-23T09:31:56Z")
The private: yes, should prevent it from being logged etc if I’m reading the documentation correctly. e.g. - hosts: all become: yes vars\_prompt: - name: ansible\_become\_pass prompt: “Enter sudo password” private: yes tasks: - name: Install a package ansible.builtin.yum: name: vim state: present however, Have you looked into host\_vars? I tend to refer to hosts with a friendly name, as often we don’t have fqdn’s or connect via a dirrectent IP to what DNS would point to etc. something like ansible\_project/ │ ├── playbook.yml │ ├── inventory/ │ └── inventory.yml │ └── host\_vars/ ├── webserver01/ │ ├── vars.yml # Plain text variables file │ └── vault.yml # Ansible Vault encrypted variables file │ ├── webserver02/ │ ├── vars.yml # Plain text variables file │ └── vault.yml # Ansible Vault encrypted variables file │ ├── sqlserver01/ │ ├── vars.yml # Plain text variables file │ └── vault.yml # Ansible Vault encrypted variables file │ └── sqlserver02/ ├── vars.yml # Plain text variables file └── vault.yml # Ansible Vault encrypted variables file Example inventory all: children: webservers: hosts: webserver01: webserver02: sqlservers: hosts: sqlserver01: sqlserver02: # Example content of host\_vars/webserver01/vars.yml ip: “192.168.1.101” port: 22 username: “your\_user” ansible\_become\_pass: “{{ P\_ansible\_become\_pass }}” # Example content of host\_vars/webserver01/vault.yml P\_ansible\_become\_pass: “your password here” I like to reference encrypted vars in the non encrypted vars so I can get a view of all vars in one place without needing to de-crypt the vault file. Hope that helps Stu