How to make Ansible display the host name before asking for the sudo password?

Question

I have an Ansible playbook to update my Debian based servers. For simplicity and security reasons, I don't want to use a vault for the passwords and I also don't want to store them in a publically accessible config file. So I ask for the password for every client with

become: yes
become_method: sudo

Now, when the playbook runs, it seems the first thing Ansible does is ask for the sudo password, but I don't know for which server (the passwords are different). Is there a way to get Ansible to print the current host name before it asks for the password?

The update playbook is similar to this:

---
- hosts:
    all
  gather_facts: no
  vars:
    verbose: false
    log_dir: "log/dist-upgrade/{{ inventory_hostname }}"
  pre_tasks:
    - block:
        - setup:
      rescue:
        - name: "Install required python-minimal package"
          raw: "apt-get update && apt-get install -y --force-yes python-apt python-minimal"
        - setup:
  tasks:
    - name: Update packages
      apt:
        update_cache: yes
        upgrade: dist
        autoremove: yes
      register: output

    - name: Check changes
      set_fact:
        updated: true
      when: not output.stdout | search("0 upgraded, 0 newly installed")

    - name: Display changes
      debug:
        msg: "{{ output.stdout_lines }}"
      when: verbose or updated is defined

    - block:
      - name: "Create log directory"
        file:
          path: "{{ log_dir }}"
          state: directory
        changed_when: false

      - name: "Write changes to logfile"
        copy:
          content: "{{ output.stdout }}"
          dest: "{{ log_dir }}/dist-upgrade_{{ ansible_date_time.iso8601 }}.log"
        changed_when: false

      when: updated is defined
      connection: local

(source: http://www.panticz.de/Debian-Ubuntu-mass-dist-upgrade-with-Ansible)

Zeitounator Zeitounator · Accepted Answer · 2020-01-10T11:30:23

Your above become configuration does not make ansible ask you for a become password: it just advises it to use become with the sudo method (which will work without any password if your have the correct keys configured for example).

If you are asked for a become password, it's because (it's a guess but I'm rather confident...) you used the --ask-become-pass option when running ansible-playbook.

In this case, you are prompted only once at the beginning of the playbook operations and this default become password will be used on all servers you connect to except if you defined an other one in your inventory for a specific host/group.

If you have different become passwords depending on your machines, you don't really have an other option: you need to declare those passwords in your inventory (and it is strongly advised to use ansible-vault encryption) or use some other mechanisms to get them out of an external application (hashicorp vault, dynamic inventory, cyberark...)

How to make Ansible display the host name before asking for the sudo password?

1 Answers