Ansible "Missing sudo password": give it the password safely, or allow the user properly

1. Check it’s really this

Reproduce it with one command:

ansible web01 -m command -a 'whoami' --become
ansible web01 -m command -a 'whoami' --become -K

The second one asks BECOME password:, and it should print root. So which user does it connect as?

ansible web01 -m command -a 'id'
ansible-inventory --host web01

2. Ask for it when you run

ansible-playbook site.yml -K

That’s the simplest answer for a person at a keyboard. It’s one password for the whole run, so hosts that have different passwords need section 3.

3. Keep it in Ansible Vault

For automation, keep it encrypted, in your repository:

ansible-vault encrypt_string 'the-password' --name 'ansible_become_password' >> group_vars/web/vault.yml

Use a space before the command, or --stdin-name to read it from a prompt, so it stays out of your shell history:

ansible-vault encrypt_string --stdin-name 'ansible_become_password' >> group_vars/web/vault.yml

Then run it with the vault’s password:

ansible-playbook site.yml --ask-vault-pass
ansible-playbook site.yml --vault-password-file ~/.vault_pass     # chmod 600

Different hosts can have different values through host_vars/web01/vault.yml.

Note the name: ansible_become_password. Older guides use ansible_sudo_pass, which is deprecated. And become_password alone is just an unrelated variable.

4. Allow the user with NOPASSWD

A dedicated deployment user often has this, as there’s no one there to type:

sudo visudo -f /etc/sudoers.d/deploy

deploy ALL=(ALL:ALL) NOPASSWD: ALL

Always go through visudo, as it checks the syntax: a mistake in sudoers can lock everyone out. See not in the sudoers file for that and recovering from it. Limit who can log in as this user, because anyone who can has root.

Ansible needs this on first setup as well, so a typical bootstrap does this once as an admin, and all later runs use it:

- hosts: all
  become: true
  tasks:
    - name: Create the deploy user
      ansible.builtin.user:
        name: deploy
        groups: sudo
        append: true
    - name: Allow deploy to sudo without a password
      ansible.builtin.copy:
        dest: /etc/sudoers.d/deploy
        content: "deploy ALL=(ALL:ALL) NOPASSWD: ALL\n"
        mode: "0440"
        validate: visudo -cf %s

validate: makes Ansible check the file before installing it, which prevents a bad file from locking you out.

Limiting NOPASSWD to a few commands generally doesn’t work with Ansible. It doesn’t run your command directly, and wraps each task in a generated Python script, so a sudoers rule can’t recognize it.

5. Other errors from the same step

fatal: [web01]: FAILED! => {"msg": "Incorrect sudo password"}

Ansible has one, and it’s wrong. Check the value in your vault, and whether this host differs. Too many wrong tries can also lock out the account for some time, through faillock.

fatal: [web01]: FAILED! => {"msg": "Timeout (12s) waiting for privilege escalation prompt: "}

The prompt never arrived. Usually it’s slow DNS on the host: sudo tries to look up the machine’s name, which is what unable to resolve host is about. Raise it for now with timeout = 30 under [defaults], and fix that.

deploy is not in the sudoers file.

Ansible’s fine, and the user has no right to sudo. See that article.

To see what’s being run:

ansible-playbook site.yml -vvv

6. You may not need become at all

A become: true at the top of a play applies to every task. Maybe only a few need root. Moving it to those tasks is good practice:

- hosts: web
  tasks:
    - name: Install nginx
      ansible.builtin.apt:
        name: nginx
      become: true

And connecting directly as root isn’t a better answer. Most servers forbid it, and you lose track of who did what.

If sudo isn’t there (sudo: command not found, as on a minimal Debian), use become_method: su, or install it first.

If you never got as far as this, and it’s the connection that fails, see Ansible UNREACHABLE. The SSH Config Generator can set up the host, user and key for your Ansible machine.