How do I use ansible_become_password on different target in the same playbook

Question

My playbook has a task to copy a file from the local box to the remote box and the last task has to use sudo to root. I am not getting it to work.

In my inventory I am trying to use I am just trying to get it to work then I can lock it down with ansible vault. I just need to see it work first.

[logserver]
mylogserver ansible_ssh_user=myuser ansible_become_password=mypassword 

In my playbook the last task using the -host param to do the work on the remote box, earlier task copies file to remote server but then I add a remote host to get the work done.

# Cat file and append destination file 
- name: cat files to destination file
  hosts: mylogserver
  gather_facts: no
  become_exe: "sudo su - root"
  tasks: 
  - name: cat contents and append to destination file
    shell: 
      cmd: /usr/bin/cat /var/tmp/test_file.txt >> /etc/some/target_file.txt 

Answer 1

For example, the inventory

shell> cat hosts
test_11 ansible_ssh_user=User1 ansible_become_password=mypassword

[logserver]
test_11

and the playbook

shell> cat pb.yml
- hosts: logserver
  gather_facts: false
  become_method: su
  become_exe: sudo su
  become_user: root
  become_flags: -l
  tasks:
    - command: whoami
      become: true
      register: result
    - debug:
        var: result.stdout

work as expected

shell> ansible-playbook -i hosts pb.yml

PLAY [logserver] ******************************************************************************

TASK [command] ********************************************************************************
changed: [test_11]

TASK [debug] **********************************************************************************
ok: [test_11] => 
  result.stdout: root

PLAY RECAP ************************************************************************************
test_11: ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Notes:

• Configuration of the method, e.g. become_method: su, is missing. See DEFAULT_BECOME_METHOD. The default is 'sudo'. For details see Using Become Plugins

• See details of the plugin from the command line shell> ansible-doc -t become su

• Use become_flags to specify options to pass to su, e.g. become_flags: -l

• Use become_user to specify the user you 'become' to execute the task, e.g. become_user: root. This example is redundant. 'root' is the default

• Specify become: true if the task shall use the configured escalation. The default is 'false'. See DEFAULT_BECOME

• Configure sudoers, e.g.

    - command: grep User1 /usr/local/etc/sudoers
      become: true
      register: result
    - debug:
        var: result.stdout

gives

TASK [debug] ***************************************************************
ok: [test_11] => 
  result.stdout: User1 ALL=(ALL) ALL

---

Encrypt the password

1. Remove the password from inventory hosts and put it into a file, e.g. in host_vars

shell> cat hosts
test_11 ansible_ssh_user=User1

[logserver]
test_11

shell> cat host_vars/test_11/ansible_become_password.yml 
ansible_become_password: mypassword

2. Encrypt the password

shell> ansible-vault encrypt host_vars/test_11/ansible_become_password.yml 
Encryption successful

shell> cat host_vars/test_11/ansible_become_password.yml
$ANSIBLE_VAULT;1.1;AES256
35646364306161623262653632393833323662633738323639353539666231373165646238636236
3462386536666463323136396131326333636365663264350a383839333536313937353637373765
...

3. Test the playbook

shell> ansible-playbook -i hosts pb.yml

PLAY [logserver] ******************************************************************************

TASK [command] ********************************************************************************
changed: [test_11]

TASK [debug] **********************************************************************************
ok: [test_11] => 
  result.stdout: root

...