In ansible, it's pretty convenient to use something like this:
- name: Make sure user password is set
user:
name: my_user
password: "{{ user_password|password_hash('sha512', 'SomeSalt') }}"
where user_password is the plaintext password, stored in an ansible vault file.
On my ansible 2.5.0 running on MacOS, this generates a password hash that looks something like this:
$6$rounds=656000$SomeSalt$PlupV2TAHwwc520gHp0dL4padL5EHa50G6hdYm.JLuy4pnP5u2F.HRAHZrGY77BwdRv5UbUGqIAbuhehS00ZD0
The problem I'm having is that the device I'm trying to configure is a Raspberry Pi, and as you can see from the hash generated, rounds=656000
. This requires quite a bit of processing power to generate the hash, and on a Raspberry Pi, it takes 10-15 seconds. That means once this password hash is set for a user, any action that requires the Raspberry Pi to generate a hash to compare against it, like logins, or password changes, also requires 10-15 seconds.
Even worse, once this password hash is set for a user, if that's the user that ansible is connecting as, every single task that ansible runs takes significantly longer to complete. The length of time my playbook takes to run against the Raspberry Pi the first time (when the tasks actually have work to do) with a default password was about 15 min. My playbook sets the user password at the very end. The second run (when the tasks don't have anything to do) was about 30 min.
I don't see a way to change the number of rounds in the documentation for the password_hash() filter. Is this value configurable in any way?