[英]`Ansible-playbook` command fails when run from a non-root user
[英]Change linux password with Ansible playbook script when connecting as a non-root user without sudo privileges
我正在尝试从 Ansible playbook 更改非 root Linux 用户的密码。 为此,我尝试按照此链接进行操作
按照说明,我可以通过在终端中输入以下代码成功更改非 root 用户的密码。
$ echo -e "your_current_pass\nlinuxpassword\nlinuxpassword" | passwd
Changing password for testuser.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully
之后,我尝试使用如下所示的 Ansible playbook 自动化代码,
---
- hosts: all
gather_facts: no
tasks:
- name: "Check if user exists"
register: user1_exists
raw: getent passwd {{ ansible_user }}
ignore_errors: true
- name: "Change {{ ansible_user }} password"
raw: echo -e "my_current_pass\nmy_new_pass\nmy_new_pass" | passwd
when: user1_exists|success
我在这里使用 Ansible 的原始模块,因为我的大多数机器都没有安装 Python。 我也没有superuser (sudo)
权限在 playbook 中使用become: True
。
此处还使用基于密码的身份验证在目标机器上运行 Ansible playbook。 不是基于 ssh 的身份验证。
但是当我执行剧本时,我收到了这个错误,
TASK [change user1 password] ***************************************************
fatal: [192.168.0.57]: FAILED! => {"changed": true, "failed": true, "rc": 10,
"stderr": "Shared connection to 192.168.0.57 closed.\r\n", "stdout": "Changing
password for testuser.\r\n(current) UNIX password: passwd: Authentication
token manipulation error\r\npasswd: password unchanged\r\n", "stdout_lines":
["Changing password for testuser.", "(current) UNIX password: passwd:
Authentication token manipulation error", "passwd: password unchanged"]}
谁能告诉我我在这里犯的错误?
使用内置用户模块而不是 shell 命令。 这需要become: True
在您的剧本中为become: True
。 请注意,用户模块的password
参数需要加密值。 password_hash
jinja 过滤器将帮助你。
- name: change user's password
user:
name: foo
password: "{{ 'passwordsaresecret' | password_hash('sha512') }}"
你的剧本几乎是正确的。 我有同样的要求,我使用了你的剧本。 您的剧本中只有一个错误,您忘记将密码变量括在 '{{}}' 大括号中。 所以我改变了你的剧本,如下所示,它对我有用。
hosts: all
gather_facts: no
tasks:
- name: "Check if user exists"
register: user1_exists
raw: getent passwd {{ ansible_user }}
ignore_errors: true
- name: "Change {{ ansible_user }} password"
raw: echo -e "{{ ansible_password }}\n{{newpwd}}\n{{newpwd}}" | passwd
when: user1_exists|success
我已经将以下内容组合在一起来解决这个问题。 密码不会显示在日志中,甚至不会显示在详细日志“-vvvvv”中,并且在远程系统的历史记录中不可见:
---
- name: Change password when connecting as a non-root/non-sudoer user.
#
# Ansible's 'user' module can only change a password if it is ran as a root user or 'become' is used.
# For a non-root user, when you run 'passwd', it asks for current password before you can enter a new one.
# Workaround: Create a a temporary script that updates the password and run that script remoteley
# and use 'no_log' directive to prevent passwords being visible in any log.
# Tested that passwords not visible in verbose output '-vvvvv' and not in 'history' of remote computers.
# The temporary script is deleted remotley automatically by 'script' module.
# Note:
# New password must comply with your passwd security policy.
hosts: all
gather_facts: no
vars_prompt:
- name: "curr_pass"
prompt: Type in current password
private: yes
- name: "new_pass"
prompt: Type in new password
private: yes
confirm: yes
## If you need to *temporary* hard-code credentials, use below.
## Delete after use or use vault if you want long-term storage.
#vars:
#- curr_pass: MyOldPass
#- new_pass: MyNewPass123!!
tasks:
- name: Create a temporary local script which will change the users password
copy:
dest: updatePassNonRootDynamic.sh
content: echo -e '{{curr_pass}}\n{{new_pass}}\n{{new_pass}}' | passwd
delegate_to: localhost
no_log: True
run_once: true
- name: Change password via temporary script on all hosts
script: updatePassNonRootDynamic.sh
- name: Remove the temporary local script
file:
path: updatePassNonRootDynamic.sh
state: absent
delegate_to: localhost
run_once: true
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.