2

How do you add a sudo password to a delegated host?

eg.

hosts: host1

  - name: Some remote command
    command: sudo some command
    register: result
    delegate_to: host2
    become: yes

I get "Incorrect sudo password" because I assume it is using the sudo pass for host1. Is there a way to make it use a different password?

lajmode
  • 133
  • 1
  • 1
  • 8

2 Answers2

1

It has been a while - but I was struggling with this as well and managed to solve it so here is a summarized answer:

As pointed out correctly the issue is that the ansible_become_password variable is set to to your original host (host1) when running the delegated task on host2.

Option 1: Add become password to inventory and delegate facts

One option to solve this is to specify the become password for host2 in your inventory, and secure it using ansible vault (as they have done here: How to specify become password for tasks delegated to localhost). Then you should be able to trigger using the correct sudo pw with delegate_facts as they did here Ansible delegate_to "Incorrect sudo password".

Option 2: Prompt and overwrite pass manually

If you prefer to get prompted for the second sudo password instead, you can do this by using a vars_promt to specify the second sudo pw during runtime:

- hosts: host1

  vars_prompt:
    - name: custom_become_pass
      prompt: enter the custom become password for host2
      private: yes

  tasks:
    ...

Then you can just replace the variable ansible_become_password before running your delegated tasks and it will use the correct sudo password:

tasks:
 - name: do stuff on host1
     ...

 - name: set custom become
   set_fact:
     ansible_become_password: '{{ custom_become_pass }}'

 - name: perform delegated task
    command: sudo some command
    register: result
    delegate_to: host2
    become: yes
nehtor.t
  • 469
  • 4
  • 11
0

You could try to use ansible_become_password variable directly inside the task's var section. Ansible doc

Artem Timchenko
  • 119
  • 5
  • Do you know how to set this only for host2? I can set this variable which will change the sudo password for host1 – lajmode Oct 15 '19 at 19:39
  • @lajmode you can set this variable directly inside the inventory file. https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html#assigning-a-variable-to-one-machine-host-variables – Artem Timchenko Oct 16 '19 at 20:22