我正在尝试从Ansible playbook更改非root Linux用户的密码。 为此,我尝试按照this link
按照说明我可以通过在终端输入以下代码来成功更改非root用户的密码。
$ echo -e "your_current_pass\nlinuxpassword\nlinuxpassword" | passwd
Changing password for testuser.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully
之后我尝试用下面的Ansible playbook自动化代码,
---
- hosts: all
gather_facts: no
tasks:
- name: "Check if user exists"
register: user1_exists
raw: getent passwd {{ ansible_user }}
ignore_errors: true
- name: "Change {{ ansible_user }} password"
raw: echo -e "my_current_pass\nmy_new_pass\nmy_new_pass" | passwd
when: user1_exists|success
我在这里使用Ansible的raw module,因为我的大多数机器都没有安装Python。我没有superuser (sudo)
权限在playbook中使用become: True
。
此处还使用基于密码的身份验证在目标计算机上运行Ansible playbook。不是基于ssh的身份验证。
但是当我执行剧本时,我收到了这个错误,
TASK [change user1 password] ***************************************************
fatal: [192.168.0.57]: FAILED! => {"changed": true, "failed": true, "rc": 10,
"stderr": "Shared connection to 192.168.0.57 closed.\r\n", "stdout": "Changing
password for testuser.\r\n(current) UNIX password: passwd: Authentication
token manipulation error\r\npasswd: password unchanged\r\n", "stdout_lines":
["Changing password for testuser.", "(current) UNIX password: passwd:
Authentication token manipulation error", "passwd: password unchanged"]}
有人能告诉我我在这里犯的错误吗?
答案 0 :(得分:1)
使用built-in user module代替shell命令。这需要您的剧本中的become: True
。请注意,用户模块的password
参数需要加密值。 password_hash
jinja过滤器可以帮助您。
- name: change user's password
user:
name: foo
password: "{{ 'passwordsaresecret' | password_hash('sha512') }}"
答案 1 :(得分:1)
您的剧本几乎是正确的。我有同样的要求,并且使用了您的剧本。您的剧本中只有一个错误,您忘记了将密码变量括在“ {{}}”花括号中。因此,我像下面那样更改了您的剧本,并且对我有用。
cell?.imageView?.sd_setImage(with: URL(string: your.url), completed: {_,_,_,_ in
self.tableView.reloadRows(at: [indexPath], with: .none)
})
答案 2 :(得分:0)
我共同努力解决以下问题。 密码不会显示在日志中,甚至不会显示冗长的日志“ -vvvvv”,并且在远程系统的历史记录中也不可见:
---
- name: Change password when connecting as a non-root/non-sudoer user.
#
# Ansible's 'user' module can only change a password if it is ran as a root user or 'become' is used.
# For a non-root user, when you run 'passwd', it asks for current password before you can enter a new one.
# Workaround: Create a a temporary script that updates the password and run that script remoteley
# and use 'no_log' directive to prevent passwords being visible in any log.
# Tested that passwords not visible in verbose output '-vvvvv' and not in 'history' of remote computers.
# The temporary script is deleted remotley automatically by 'script' module.
# Note:
# New password must comply with your passwd security policy.
hosts: all
gather_facts: no
vars_prompt:
- name: "curr_pass"
prompt: Type in current password
private: yes
- name: "new_pass"
prompt: Type in new password
private: yes
confirm: yes
## If you need to *temporary* hard-code credentials, use below.
## Delete after use or use vault if you want long-term storage.
#vars:
#- curr_pass: MyOldPass
#- new_pass: MyNewPass123!!
tasks:
- name: Create a temporary local script which will change the users password
copy:
dest: updatePassNonRootDynamic.sh
content: echo -e '{{curr_pass}}\n{{new_pass}}\n{{new_pass}}' | passwd
delegate_to: localhost
no_log: True
run_once: true
- name: Change password via temporary script on all hosts
script: updatePassNonRootDynamic.sh
- name: Remove the temporary local script
file:
path: updatePassNonRootDynamic.sh
state: absent
delegate_to: localhost
run_once: true