# Update Ansible password inside an ansible run **URL:** \ **Category:** Get Help\ **Created:** [November 20, 2024, 10:40pm UTC](https://forum.ansible.com/t/update-ansible-password-inside-an-ansible-run/11032 "2024-11-20T22:40:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![HexaOrko](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@HexaOrko](https://forum.ansible.com/u/HexaOrko)\ **Post date:** [November 20, 2024, 10:40pm UTC](https://forum.ansible.com/t/update-ansible-password-inside-an-ansible-run/11032/1 "2024-11-20T22:40:27Z")
Hi, i try to update the password of the ansible user, which works, but after updateing the password the next step failed because Authentication failed. I tried to update ansible\_become\_password but maybe it can not be updated on runtime? here are the relevant parts of my playbook ```auto - name: "Generate an ansible secret for host {{ new_hostname }}" ansible.builtin.set_fact: new_ansible_password: "{{ lookup('ansible.builtin.password', '/dev/null', length=32) }}" - name: Insert or Update ansible password inside passwordstore ansible.builtin.set_fact: pass_storage: "{{ lookup('community.general.passwordstore', 'clients/'+ new_hostname +'/ansible_password', userpass=new_ansible_password, preserve=false, overwrite=true, create=true, timestamp=false) }}" - name: Set new ansible password on system ansible.builtin.user: name: ansible password: "{{ new_ansible_password | password_hash('sha512', password_salt) }}" state: present - name: Update ansible_become_password to new password ansible.builtin.set_fact: ansible_become_password: "{{ new_ansible_password }}" - name: "Force password change for {{ my_user }}" ansible.builtin.shell: chage -d 0 "{{ username }}" when: adduser.changed - name: create ssh related user folder ansible.builtin.file: path: "/home/{{username}}/.ssh/" state: directory ``` unfortunately this does not work, i get following output ```sh TASK [Generate a ansible secret for host deploy-test] ************************************************** ok: [vm_provision] TASK [Insert or Update ansible password inside passwordstore] ****************************************** ok: [vm_provision] TASK [Set new ansible password on system] ************************************************************** [DEPRECATION WARNING]: Encryption using the Python crypt module is deprecated. The Python crypt module is deprecated and will be removed from Python 3.13. Install the passlib library for continued encryption functionality. This feature will be removed in version 2.17. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg. changed: [vm_provision] TASK [Update ansible_become_password to new password] ************************************************** ok: [vm_provision] TASK [Force password change for HexaOrko] *************************************************************** skipping: [vm_provision] TASK [create ssh related user folder] ****************************************************************** fatal: [vm_provision]: FAILED! => {"changed": false, "module_stderr": "Warning: Permanently added '192.168.1.254' (ED25519) to the list of known hosts.\r\nConnection to 192.168.1.254 closed.\r\n", "module_stdout": "\r\r\ndoas: Authentication failed\r\n", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} ``` ---
**Author:** ![netgirard](https://avatars.discourse-cdn.com/v4/letter/n/e8c25b/32.png) [@netgirard](https://forum.ansible.com/u/netgirard)\ **Post date:** [November 21, 2024, 3:02pm UTC](https://forum.ansible.com/t/update-ansible-password-inside-an-ansible-run/11032/2 "2024-11-21T15:02:34Z")
I do similar operations frequently with network devices, the only difference being is that there is no use for ansible\_become\_password, so I am typically updating ansible\_password. I would suggest trying that, as you have to get through SSH authentication first, either with a key or a password, before you can even think about using the privilege escalation command. And from my limited server management experience, issues with the become method usually have more of a hint that you are having a problem with sudo, or whatever the become method is. Another thing that has been helpful to me when doing bootstrap type operations where I actually switch the ansible\_connection type was issuing an ansible.builtin.meta: reset\_connection, but that doesn’t seem like it would apply here. ---
**Author:** ![HexaOrko](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@HexaOrko](https://forum.ansible.com/u/HexaOrko)\ **Post date:** [November 24, 2024, 12:12pm UTC](https://forum.ansible.com/t/update-ansible-password-inside-an-ansible-run/11032/4 "2024-11-24T12:12:19Z")
I guess i found the problem, there is a inaccuracy, according to the [ansible docs](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#become-connection-variables) the variable name to use for example inside a inventory is **ansible\_become\_password** (and there it works) but i also found hints that the name inside the play is simply _ansible\_pass_, but when i look at the [source of truth](https://github.com/ansible/ansible/blob/devel/lib/ansible/playbook/play_context.py) the correct variable inside the play seams to be **ansible\_become\_pass** so lets do a quick test ```auto - name: quick and dirty test debug: msg: - "ansible_become_password: {{ ansible_become_password|default('does not exits') }}" - "ansible_become_pass: {{ ansible_become_pass|default('does not exits')}}" - "ansible_pass: {{ ansible_pass|default('does not exits')}}" ``` and yes this looks better ```sh TASK [quick and dirty test] *************************************************** ok: [vm_provision] => { "msg": [ "ansible_become_password: does not exits", "ansible_become_pass: my-secret-password", "ansible_pass: does not exits" ] } ``` ---
**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\ **Post date:** [November 25, 2024, 2:18pm UTC](https://forum.ansible.com/t/update-ansible-password-inside-an-ansible-run/11032/5 "2024-11-25T14:18:27Z")
The first documentation link includes the note: > The variables defined above are generic for all become plugins but plugin-specific ones can also be set instead. Please see the documentation for each plugin for a list of all options the plugin has and how they can be defined. A full list of become plugins in Ansible can be found at Become plugins. It’s ultimately up to the become plugin which variables are used. Here’s the full list for the sudo become method, for example [ansible.builtin.sudo become – Substitute User DO — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/sudo_become.html#parameter-become_pass) (which does support an `ansible_sudo_pass` but not `ansible_pass`). PlayContext is not the source of truth, the variables are determined from the plugin [here](https://github.com/ansible/ansible/blob/v2.18.0/lib/ansible/executor/task_executor.py#L1115). ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [December 25, 2024, 2:18pm UTC](https://forum.ansible.com/t/update-ansible-password-inside-an-ansible-run/11032/6 "2024-12-25T14:18:53Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.