Ansible Playbook切换服务账户执行时密码传递失败求助

需求与问题 #

需求：使用单个Ansible Playbook，在操作系统部署完成后通过初始密码执行，先添加服务账户，后续任务以该服务账户身份运行。
问题：第二个Play无法正确使用新创建的服务账户，系统已识别到该账户，但密码未正确传递，导致SSH权限拒绝错误。

原Playbook代码 #

---
    #name: Playbook to run through roles to provision new server
  - hosts: all
    gather_facts: false
    become: true
    #become_user: '{{ root_user }}' #this is commented out to show what acct is being used    
    tasks: 
      #User root account to add new service account, so root account can also be managed.
      - name: Add Service Accounts
        include_tasks: ../steps/ServiceAccount_add.yml 

      - name: Pause for 30 seconds
        ansible.builtin.pause:
          seconds: 30

#2nd play to be ran as service account so root is not used.
  - hosts: all
    gather_facts: false
    become: true
    remote_user: '{{ Service_Account }}'
    become_user: '{{ Service_Account }}'
    vars:
      ansible_become_password: '{{ Service_AccountPW }}'
      remote_user_password: '{{ Service_AccountPW }}'
    tasks: 
      - name: Run Baseline
        include_tasks: ../steps/Yum_baseline.yml

      - name: Run Update
        include_tasks: ../steps/Yum_Update.yml

错误日志 #

<IPADDRESS> SSH: EXEC sshpass -d8 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="service_account"' -o ConnectTimeout=10 -o ControlPath=/tmp/bwrap_656_m3k5zy9e/awx_656_4iz9_26u/cp/a07c97f8e1 IPADDRESS '/bin/sh -c '"'"'/usr/bin/python && sleep 0'"'"''
<IPADDRESS> (5, '', 'Permission denied, please try again.\r\nPermission denied, please try again.\r\nPermission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n')
fatal: [IPADDRESS]: UNREACHABLE! => {
    "changed": false, 
    "msg": "Invalid/incorrect password: Permission denied, please try again.\r\nPermission denied, please try again.\r\nPermission denied (publickey,gssapi-keyex,gssapi-with-mic,password).", 
    "unreachable": true
}

问题原因与修复方案 #

1. SSH登录密码变量用错了 #

你在第二个Play里用了remote_user_password，但Ansible控制SSH登录密码的内置变量是ansible_ssh_pass，remote_user_password不是Ansible认可的变量，导致密码根本没传递到SSH连接流程中。

2. 冗余的become配置 #

第二个Play里设置了become: true和become_user: '{{ Service_Account }}'，但你已经通过remote_user直接登录到该账户了，再提权到自己完全没必要，反而会干扰正常登录逻辑，直接删掉这两项即可。

修复后的Playbook #

---
# 第一个Play：通过root创建服务账户
- hosts: all
  gather_facts: false
  become: true
  tasks: 
    - name: 添加服务账户
      include_tasks: ../steps/ServiceAccount_add.yml 

    - name: 等待30秒确保账户生效
      ansible.builtin.pause:
        seconds: 30

# 第二个Play：用新服务账户执行后续任务
- hosts: all
  gather_facts: false
  remote_user: '{{ Service_Account }}'
  vars:
    ansible_ssh_pass: '{{ Service_AccountPW }}'
    # 如果后续任务需要提权到root，再打开下面的配置
    # become: true
    # become_user: root
    # ansible_become_password: '{{ Service_AccountPW }}'
  tasks: 
    - name: 执行基线配置
      include_tasks: ../steps/Yum_baseline.yml

    - name: 执行系统更新
      include_tasks: ../steps/Yum_Update.yml

额外检查点 #

• 确认ServiceAccount_add.yml里正确设置了服务账户的密码，且Service_AccountPW变量在整个Playbook中可访问（比如通过inventory文件、vars文件或命令行参数传递）。
• 检查目标服务器的SSH配置（/etc/ssh/sshd_config），确保PasswordAuthentication设置为yes，如果禁用了密码登录，要么临时开启，要么给服务账户配置SSH密钥。
• 如果后续任务需要提权，要确保服务账户在sudoers列表中，且配置了无需输入密码的权限（或者确保ansible_become_password正确）。

内容的提问来源于stack exchange，提问作者John