1

In ansible, it's pretty convenient to use something like this:

- name: Make sure user password is set 
  user:
    name: my_user
    password: "{{ user_password|password_hash('sha512', 'SomeSalt') }}"

where user_password is the plaintext password, stored in an ansible vault file.

On my ansible 2.5.0 running on MacOS, this generates a password hash that looks something like this:

$6$rounds=656000$SomeSalt$PlupV2TAHwwc520gHp0dL4padL5EHa50G6hdYm.JLuy4pnP5u2F.HRAHZrGY77BwdRv5UbUGqIAbuhehS00ZD0

The problem I'm having is that the device I'm trying to configure is a Raspberry Pi, and as you can see from the hash generated, rounds=656000. This requires quite a bit of processing power to generate the hash, and on a Raspberry Pi, it takes 10-15 seconds. That means once this password hash is set for a user, any action that requires the Raspberry Pi to generate a hash to compare against it, like logins, or password changes, also requires 10-15 seconds.

Even worse, once this password hash is set for a user, if that's the user that ansible is connecting as, every single task that ansible runs takes significantly longer to complete. The length of time my playbook takes to run against the Raspberry Pi the first time (when the tasks actually have work to do) with a default password was about 15 min. My playbook sets the user password at the very end. The second run (when the tasks don't have anything to do) was about 30 min.

I don't see a way to change the number of rounds in the documentation for the password_hash() filter. Is this value configurable in any way?

3 Answers 3

1

There doesn't seem to be any option to provide a rounds argument using the password_hash filter. The function that gets called by the filter only accepts the password, hash type, and salt as arguments.

If you really need to set this, you could install mkpasswd (part of the whois package on Debian/Ubuntu), and run that. This isn't total secure, if another person was watching running processes on the system you are running ansible on, they would see the password in the 'ps ax' output.

- hosts: slowremote
  gather_facts: no
  tasks:
  - shell: |
      echo 'hunter2' | mkpasswd --method=sha-512 --rounds=1000 --stdin
    register: results
    delegate_to: localhost
  - debug:
      var: results.stdout_lines
  - name: Make sure user password is set 
    user:
      name: my_user
      password: "{{results.stdout_lines}}"
1

Doing a bit of research, apparently this was a feature request.

It got implemented here.

There's a merge request for that feature here.

As far as I can tell, this feature is still a work in progress, and was closed for inactivity without being merged into the main ansible code. It may be reopened and completed at some point, but the current ansible code doesn't have this feature.

1

I used expect module to execute passwd:

- name: Install required lib
  apt:
    name: 'python-expect'
    state: present
- name: Change user's password
  expect:
    command: passwd pi
    responses:
      'Enter new UNIX password:': "{{ new_password }}"
      'Retype new UNIX password:': "{{ new_password }}"
  no_log: True

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .