# Using lookup plugin to check SHA512 password hash

**URL:** <https://forum.ansible.com/t/using-lookup-plugin-to-check-sha512-password-hash/24384>\
**Category:** Ansible Project\
**Created:** [May 3, 2017, 5:25am UTC](https://forum.ansible.com/t/using-lookup-plugin-to-check-sha512-password-hash/24384 "2017-05-03T05:25:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![The\_Gripmaster](https://avatars.discourse-cdn.com/v4/letter/t/b38774/32.png) [@The\_Gripmaster](https://forum.ansible.com/u/The_Gripmaster)\
**Post date:** [May 3, 2017, 5:25am UTC](https://forum.ansible.com/t/using-lookup-plugin-to-check-sha512-password-hash/24384/1 "2017-05-03T05:25:50Z")

</div>

In my Ansible git repo, I have a var file with contents like this

vault\_users:  
alex:  
password: $1$zMcbvpnN$DxP/LRsINODRkBxG0Kz4.1  
danny:  
password: $1$zMcbvpnN$DxP/LRsINODRkBxG0Kz4.1  
gary:  
password: $1$zMcbvpnN$DxP/LRsINODRkBxG0Kz4.1

Now, I want to check if the password hashes from this var file matches the ones from the /etc/shadow file on a remote server. I know it is possible to mix Ansible and a bash/python script to get what I want. **I would like to know if it is possible** to do this using pure Ansible playbooks only (no bash/python scripts) using the lookup plugin or some other Ansible feature.

---

<div class="post-metadata">

**Author:** ![Paul\_Totterman](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@Paul\_Totterman](https://forum.ansible.com/u/Paul_Totterman)\
**Post date:** [May 3, 2017, 7:46am UTC](https://forum.ansible.com/t/using-lookup-plugin-to-check-sha512-password-hash/24384/2 "2017-05-03T07:46:54Z")

</div>

> Now, I want to check if the password hashes from this var file matches the ones from the /etc/shadow file on a remote server. I know it is possible to mix Ansible and a bash/python script to get what I want. **I would like to know if it is possible** to do this using pure Ansible playbooks only (no bash/python scripts) using the lookup plugin or some other Ansible feature.

Write a playbook to change passwords and run it in check mode?

Cheers,  
Paul

---

<div class="post-metadata">

**Author:** ![The\_Gripmaster](https://avatars.discourse-cdn.com/v4/letter/t/b38774/32.png) [@The\_Gripmaster](https://forum.ansible.com/u/The_Gripmaster)\
**Post date:** [May 3, 2017, 9:40am UTC](https://forum.ansible.com/t/using-lookup-plugin-to-check-sha512-password-hash/24384/3 "2017-05-03T09:40:25Z")

</div>

That’s exactly what I am doing right now using the user module. The problem is if anything other than the password is changed, like the user’s groups on the remote server I am checking against, Ansible output shows changed. And then I have to scroll through hundreds of lines to find out which user’s settings changed. It would be nice if Ansible could tell me which particular user’s password was different.