1

I would like to use ansible vault passwords for the ssh and become passwords when running ansible-playbook. This way I dont need to type them in when using the parameters --ask-become-pass or the ssh password.

Problem: Every time I run my ansible-playbook command I am prompted for a ssh and become password.

My original command where I need to type the SSH and become password:

ansible-playbook playbook.yaml --ask-become-pass -e ansible_python_interpreter='/usr/bin/python3' -i inventory -k --ask-vault-pass -T 40

Command I have tried to make ansible-playbook use my vault passwords instead of my typing them in:

ansible-playbook playbook.yaml -e ansible_python_interpreter='/usr/bin/python3' -i inventory -k -T 40 --extra-vars @group_vars/all/main.yaml

I tried creating the directory structure from where the command is run group_vars/all/main.yaml, where main.yaml has my ansible vault passwords for "ansible_ssh_user", "ansible_ssh_pass", and "ansible_become_pass"

I even tried putting my password in the command:

ansible-playbook playbook.yaml -e ansible_python_interpreter='/usr/bin/python3' -i inventory -k -T 40 --extra-vars ansible_ssh_pass=$'"MyP455word"'

ansible-playbook playbook.yaml -e ansible_python_interpreter='/usr/bin/python3' -i inventory -k -T 40 --extra-vars ansible_ssh_pass='MyP455word'

Every time I run my playbook command, I keep getting prompted for a SSH pass and become pass. What am I missing here?

I have already read these two posts, both of which were not clear to me on the exact process, so neither helped: https://serverfault.com/questions/686347/ansible-command-line-retriving-ssh-password-from-vault

Ansible vault password in group_vars not detected

Any recommendations?

EDIT: Including my playbook, role, settings.yaml, and inventory file as well.

Here is my playbook:

- name: Enable NFS server
  hosts: nfs_server
  gather_facts: False
  become: yes
  roles:
    - { role: nfs_enable }

Here is the role located in roles/nfs_enable/tasks/main.yaml

- name: Include vars
  include_vars:
      file: ../../../settings.yaml
      name: settings

- name: Start NFS service on server
  systemd:
    state: restarted
    name: nfs-kernel-server.service

Here is my settings file

#nfs share directory
nfs_ssh_user: admin
nfs_share_dir: "/nfs-share/logs/"

ansible_become_pass: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          55543131373731393764333932626261383765326432613239356638616234643335643438326165
          3332363366623937386635653463656537353663326139360a316436356634386135653038643238
          61313123656332663232633833366133373630396434346165336337623364383261356234653461
          3335386135553835610a303666346561376161366330353935363937663233353064653938646263
          6539
ansible_ssh_pass: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          55543131373731393764333932626261383765326432613239356638616234643335643438326165
          3332363366623937386635653463656537353663326139360a316436356634386135653038643238
          61313123656332663232633833366133373630396434346165336337623364383261356234653461
          3335386135553835610a303666346561376161366330353935363937663233353064653938646263
          6539

Here is my inventory

[nfs_server]
10.10.10.10 ansible_ssh_user=admin ansible_ssh_private_key_file=~/.ssh/id_ed25519
Dave
  • 727
  • 1
  • 9
  • 20
  • 2
    You're being prompted for the ssh pass because of the `-k` (short for `--ask-pass`), and at least one of your commands includes `--ask-become-pass`, which would explain the other prompt – mdaniel Jan 14 '21 at 17:14
  • Thanks! that fixed the ansible_ssh_pass, now it works from my config file. However, my playbook refuses to recognize my "ansible_become_pass" I keep getting this error `{"msg": "Missing sudo password"}`. If I force the password with "--ask-become-pass" it works, but will not recognize the password from my config. Any ideas? – Dave Jan 14 '21 at 20:06
  • I hope you can appreciate that with the level of detail you have provided, the burden is upon you to write up an [MCVE](https://stackoverflow.com/help/mcve) or _at bare mimum_ include the playbook code that you believe should be working, not just command lines since the yaml details matter a lot – mdaniel Jan 14 '21 at 20:40
  • @mdaniel, I have updated the post to include my playbook, role, settings.yaml, and inventory file. – Dave Jan 15 '21 at 12:04

0 Answers0