# with\_nested failing, not sure why

**URL:** <https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851>\
**Category:** Ansible Project\
**Created:** [August 4, 2014, 4:18pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851 "2014-08-04T16:18:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Oliver](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@John\_Oliver](https://forum.ansible.com/u/John_Oliver)\
**Post date:** [August 4, 2014, 4:18pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/1 "2014-08-04T16:18:28Z")

</div>

This task:

- name: Lock accounts after 3 unsuccessful logon attempts  
lineinfile: dest=/etc/pam.d/{{ item[0] }}-auth-ac  
regexp=‘^auth._pam\_faillock.so\ auth._\ deny=3\ unlock\_time=604800\ fail\_interval=900’  
insertafter=‘^auth._pam\_unix.so._’  
line={{ item[1] }}  
with\_nested:
- [‘system’, ‘password’]
- [‘auth [default=die] pam\_faillock.so authfail deny=3 unlock\_time=604800 fail\_interval=900’, ‘auth required pam\_faillock.so authsucc deny=3 unlock\_time=604800 fail\_interval=900’ ]

gives me:

TASK: [Lock accounts after 3 unsuccessful logon attempts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
failed: [jedisbuild] =\> (item=[‘system’, ‘auth [default=die] pam\_faillock.so authfail deny=3 unlock\_time=604800 fail\_interval=900’]) =\> {“failed”: true, “item”: [“system”, “auth [default=die] pam\_faillock.so authfail deny=3 unlock\_time=604800 fail\_interval=900”]}  
msg: this module requires key=value arguments ([‘dest=/etc/pam.d/system-auth-ac’, ‘regexp=^auth._pam\_faillock\.so\ auth._\ deny=3\ unlock\_time=604800\ fail\_interval=900’, ‘insertafter=^auth._pam\_unix\.so._’, ‘line=auth’, ‘[default=die]’, ‘pam\_faillock.so’, ‘authfail’, ‘deny=3’, ‘unlock\_time=604800’, ‘fail\_interval=900’])  
failed: [jedisbuild] =\> (item=[‘system’, ‘auth required pam\_faillock.so authsucc deny=3 unlock\_time=604800 fail\_interval=900’]) =\> {“failed”: true, “item”: [“system”, “auth required pam\_faillock.so authsucc deny=3 unlock\_time=604800 fail\_interval=900”]}  
msg: this module requires key=value arguments ([‘dest=/etc/pam.d/system-auth-ac’, ‘regexp=^auth._pam\_faillock\.so\ auth._\ deny=3\ unlock\_time=604800\ fail\_interval=900’, ‘insertafter=^auth._pam\_unix\.so._’, ‘line=auth’, ‘required’, ‘pam\_faillock.so’, ‘authsucc’, ‘deny=3’, ‘unlock\_time=604800’, ‘fail\_interval=900’])  
failed: [jedisbuild] =\> (item=[‘password’, ‘auth [default=die] pam\_faillock.so authfail deny=3 unlock\_time=604800 fail\_interval=900’]) =\> {“failed”: true, “item”: [“password”, “auth [default=die] pam\_faillock.so authfail deny=3 unlock\_time=604800 fail\_interval=900”]}  
msg: this module requires key=value arguments ([‘dest=/etc/pam.d/password-auth-ac’, ‘regexp=^auth._pam\_faillock\.so\ auth._\ deny=3\ unlock\_time=604800\ fail\_interval=900’, ‘insertafter=^auth._pam\_unix\.so._’, ‘line=auth’, ‘[default=die]’, ‘pam\_faillock.so’, ‘authfail’, ‘deny=3’, ‘unlock\_time=604800’, ‘fail\_interval=900’])  
failed: [jedisbuild] =\> (item=[‘password’, ‘auth required pam\_faillock.so authsucc deny=3 unlock\_time=604800 fail\_interval=900’]) =\> {“failed”: true, “item”: [“password”, “auth required pam\_faillock.so authsucc deny=3 unlock\_time=604800 fail\_interval=900”]}  
msg: this module requires key=value arguments ([‘dest=/etc/pam.d/password-auth-ac’, ‘regexp=^auth._pam\_faillock\.so\ auth._\ deny=3\ unlock\_time=604800\ fail\_interval=900’, ‘insertafter=^auth._pam\_unix\.so._’, ‘line=auth’, ‘required’, ‘pam\_faillock.so’, ‘authsucc’, ‘deny=3’, ‘unlock\_time=604800’, ‘fail\_interval=900’])

Target files:

[joliver@build ~]$ sudo cat /etc/pam.d/system-auth-ac  
#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth required pam\_env.so  
auth sufficient pam\_fprintd.so  
auth sufficient pam\_unix.so try\_first\_pass  
auth requisite pam\_succeed\_if.so uid \>= 500 quiet  
auth sufficient pam\_krb5.so use\_first\_pass  
auth required pam\_deny.so

account required pam\_unix.so broken\_shadow  
account sufficient pam\_localuser.so  
account sufficient pam\_succeed\_if.so uid \< 500 quiet  
account [default=bad success=ok user\_unknown=ignore] pam\_krb5.so  
account required pam\_permit.so

password requisite pam\_cracklib.so try\_first\_pass retry=3 type=  
password sufficient pam\_unix.so sha512 shadow try\_first\_pass use\_authtok  
password sufficient pam\_krb5.so use\_authtok  
password required pam\_deny.so

session optional pam\_keyinit.so revoke  
session required pam\_limits.so  
session [success=1 default=ignore] pam\_succeed\_if.so service in crond quiet use\_uid  
session required pam\_unix.so  
session optional pam\_krb5.so  
[joliver@build ~]$ sudo cat /etc/pam.d/password-auth-ac  
#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth required pam\_env.so  
auth sufficient pam\_unix.so nullok try\_first\_pass  
auth requisite pam\_succeed\_if.so uid \>= 500 quiet  
auth sufficient pam\_krb5.so use\_first\_pass  
auth required pam\_deny.so

account required pam\_unix.so broken\_shadow  
account sufficient pam\_localuser.so  
account sufficient pam\_succeed\_if.so uid \< 500 quiet  
account [default=bad success=ok user\_unknown=ignore] pam\_krb5.so  
account required pam\_permit.so

password requisite pam\_cracklib.so try\_first\_pass retry=3 type=  
password sufficient pam\_unix.so sha512 shadow nullok try\_first\_pass use\_authtok  
password sufficient pam\_krb5.so use\_authtok  
password required pam\_deny.so

session optional pam\_keyinit.so revoke  
session required pam\_limits.so  
session [success=1 default=ignore] pam\_succeed\_if.so service in crond quiet use\_uid  
session required pam\_unix.so  
session optional pam\_krb5.so

---

<div class="post-metadata">

**Author:** ![Mike\_Ray](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mike\_Ray](https://forum.ansible.com/u/Mike_Ray)\
**Post date:** [August 4, 2014, 4:30pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/2 "2014-08-04T16:30:15Z")

</div>

I can’t say as I’m familiar with the nested construction, but at least part of the problem is given to you:

**msg: this module requires key=value arguments** ([‘dest=/etc/pam.d/system-auth-ac’, ‘regexp=^auth._pam\_faillock\.so\ auth._\ deny=3\ unlock\_time=604800\ fail\_interval=900’, ‘insertafter=^auth._pam\_unix\.so._’, ‘line=auth’, ‘[default=die]’, ‘pam\_faillock.so’, ‘authfail’, ‘deny=3’, ‘unlock\_time=604800’, ‘fail\_interval=900’])

The module is splitting your input on the spaces, which is what the information in the parenthesis state. So you end up with ‘dest=/etc/pam.d/system-auth-ac’ and then a whole bunch of other junk.

I can’t recall for sure, but using double-quotes may resolve this (e.g. “this is your input now”).

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 4, 2014, 5:22pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/3 "2014-08-04T17:22:38Z")

</div>

For starters,

ansible --version ?

---

<div class="post-metadata">

**Author:** ![John\_Oliver](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@John\_Oliver](https://forum.ansible.com/u/John_Oliver)\
**Post date:** [August 4, 2014, 6:03pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/4 "2014-08-04T18:03:12Z")

</div>

1.6.6

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 4, 2014, 8:17pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/5 "2014-08-04T20:17:05Z")

</div>

Ok, so the various security fixes in the 1.6.X series were largely patched out by 1.6.10, and are even better on the development branch, where we are finishing up some minor things getting ready for a release.

Please check and see if this is an issue in 1.6.10, and my expectation is there’s a good chance you’ll be good to go 🙂

---

<div class="post-metadata">

**Author:** ![John\_Oliver](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@John\_Oliver](https://forum.ansible.com/u/John_Oliver)\
**Post date:** [August 4, 2014, 10:41pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/6 "2014-08-04T22:41:06Z")

</div>

Thanks. I’ve asked the maintainer of that port at MacPorts to update, or if I can help maintain it.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 5, 2014, 4:20pm UTC](https://forum.ansible.com/t/with-nested-failing-not-sure-why/15851/7 "2014-08-05T16:20:02Z")

</div>

Great, thanks!