# trying to reset root password by using .yml playbook, but its failed with permission denied error, however same .yml playbook is working via terminal. **URL:** \ **Category:** Ansible Project\ **Tags:** ansible-project\ **Created:** [July 21, 2018, 3:42pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116 "2018-07-21T15:42:55Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jean-yves](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jean-yves](https://forum.ansible.com/u/jean-yves)\ **Post date:** [July 21, 2018, 3:42pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/1 "2018-07-21T15:42:55Z")
Hi, Are become & become\_user setted ? Reagrds, JYL ---
**Author:** ![Deepan\_M](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Deepan\_M](https://forum.ansible.com/u/Deepan_M)\ **Post date:** [July 21, 2018, 4:28pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/2 "2018-07-21T16:28:03Z")
Hi, Below is my conf details cat ansible.cfg [defaults] host\_key\_checking = False remote\_user = q5c9nf32 inventory = inventory [privilege\_escalation] become = True become\_method = sudo become\_user = root become\_ask\_pass = True Thanks, Deepan M ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [July 21, 2018, 5:42pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/3 "2018-07-21T17:42:27Z")
You should run ansible-playbook with -vvvv and see if that is giving some more useful information about what is happening. ---
**Author:** ![Deepan\_M](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Deepan\_M](https://forum.ansible.com/u/Deepan_M)\ **Post date:** [July 21, 2018, 6:02pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/4 "2018-07-21T18:02:28Z")
Hi, If i run like below from terminal, then its working perfect but when i try from jenkins, its failing. #ansible-playbook change-root-password1.yml Thanks, Deepan M ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [July 21, 2018, 6:27pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/5 "2018-07-21T18:27:39Z")
And that is why you need to run it with -vvvv in Jenkins to possible see what is happening. Playing a guessing game on what it could be is not very futile. ---
**Author:** ![Deepan\_M](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Deepan\_M](https://forum.ansible.com/u/Deepan_M)\ **Post date:** [July 21, 2018, 6:34pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/6 "2018-07-21T18:34:20Z")
Not aware where I need to add -vvvv in Jenkins tool?? Need to add as extra var? Thanks, Deepan ---
**Author:** ![Deepan\_M](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Deepan\_M](https://forum.ansible.com/u/Deepan_M)\ **Post date:** [July 22, 2018, 10:22am UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/7 "2018-07-22T10:22:11Z")
Hi, Please find below -vvvv output and let to know how to fix this issue. ---
**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\ **Post date:** [July 22, 2018, 8:59pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/8 "2018-07-22T20:59:22Z")
Since your ansible.cfg ‘become\_ask\_pass = True’, are you providing the sudo password on the command line for Jenkins to pass to ansible-playbook? ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [July 23, 2018, 8:33am UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/9 "2018-07-23T08:33:30Z")
> Hi, > >   Please find below -vvvv output and let to know how to fix this issue. You should have just posted plain text with long line breaking to off. This is very difficult to write answer on. > Building in workspace > /opt/hcl/support/unix/l5c9nf32/.jenkins/workspace/root\_reset\_pass[root\_rese= > t\_pass] > $ /usr/bin/ansible-playbook /Ansible\_project/change-root-password1.yml > -i /Ansible\_project/inventory -f 100 -e \*\*\*\*\*\*\*\* -e > ansible\_user=3Dq5c9nf32 -vvvvansible-playbook 2.4.2.0 config file =3D > /etc/ansible/ansible.cfg configured module search path =3D ansible-playbook is picking up /etc/ansible/ansible.cfg and I guess that the ansible.cfg you have edited is in /Ansible\_project If this assumption is right you need to change the current woring directory i Jenkins to be /Ansible\_project since ansible-playbook picks up ansible.cfg in cwd. ---
**Author:** ![Deepan\_M](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Deepan\_M](https://forum.ansible.com/u/Deepan_M)\ **Post date:** [July 24, 2018, 7:21pm UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/10 "2018-07-24T19:21:59Z")
Thanks Kai for your suggestion, its working perfect. in Jenkins I dont find the way to change directory, however default file is picking it up. Thanks all for giving your supports. ansible --version [WARNING]: log file at /var/log/ansible.log is not writeable and we cannot create it, aborting ansible 2.4.2.0 **config file = /etc/ansible/ansible.cfg** configured module search path = [u’/home/q5c9nf32/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /usr/bin/ansible python version = 2.7.5 (default, Feb 20 2018, 09:19:12) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)] ```auto Started by user deepan Building in workspace /opt/hcl/support/unix/l5c9nf32/.jenkins/workspace/root_reset_pass [root_reset_pass] $ /usr/bin/ansible-playbook /Ansible_project/change-root-password1.yml -i /Ansible_project/inventory -f 100 -e ******** -e ansible_user=q5c9nf32 [WARNING]: log file at /var/log/ansible.log is not writeable and we cannot create it, aborting /usr/lib64/python2.7/getpass.py:83: GetPassWarning: Can not control echo on the terminal. passwd = fallback_getpass(prompt, stream) Warning: Password input may be echoed. SUDO password: PLAY [xerox] ******************************************************************* TASK [Gathering Facts] ********************************************************* ok: [usa7061lv1771] TASK [Change root password] **************************************************** changed: [usa7061lv1771] PLAY RECAP ********************************************************************* usa7061lv1771 : ok=2 changed=1 unreachable=0 failed=0 Finished: SUCCESS ``` Regards, Deepan M ---
**Author:** ![Jobin\_A\_T\_A\_T](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@Jobin\_A\_T\_A\_T](https://forum.ansible.com/u/Jobin_A_T_A_T)\ **Post date:** [July 31, 2018, 8:31am UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/11 "2018-07-31T08:31:58Z")
hi check this one - name: changing root password user: name: “root” ## Should not have “-” password: “$6$rounds=656000$XCYDmKM2Wh6LkAkf$2t/9L0OP4yJgy3wukrahPAM1qZG.SFNoe3eR53EqTq1t6.X.9YL78PJ2uje6dAp1Xxt8UqDe.kqj2/9F7bsvM/” i generated the the password hash using the python code python -c “from passlib.hash import sha512\_crypt; import getpass; print sha512\_crypt.encrypt(getpass.getpass())” ---
**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\ **Post date:** [August 3, 2018, 2:59am UTC](https://forum.ansible.com/t/trying-to-reset-root-password-by-using-yml-playbook-but-its-failed-with-permission-denied-error-however-same-yml-playbook-is-working-via-terminal/28116/12 "2018-08-03T02:59:11Z")
To save the call to the external Python command to encrypt the password, you can use the Jinja2 “password\_hash” documented here: [https://docs.ansible.com/ansible/latest/user\_guide/playbooks\_filters.html#hashing-filters](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#hashing-filters) So your example could look like this: - name: changing root password user: name: “root” password: “{{ root\_password | password\_hash(‘sha512’) }}” Where “root\_password” is a variable set earlier (hopefully stored as an Ansible vaulted variable). The only drawback here is that the hashed password will be the same on all systems. Use a “salted hash” [Note 1] so they are not easily noticeable as identical to the casual observer: password: “{{ root\_password | password\_hash(‘sha512’, 65534|random(seed=inventory\_hostname)|string) }}” This will use the hostname as a consistent seed to the random function, then generate a number from 0…65534, finally turning that into a string for the password\_hash funciton to use. Note 1: What is a “salted hash” in computers? [https://www.skyhighnetworks.com/cloud-security-blog/what-is-a-salt-and-how-does-it-make-password-hashing-more-secure/](https://www.skyhighnetworks.com/cloud-security-blog/what-is-a-salt-and-how-does-it-make-password-hashing-more-secure/)