How can I stop a root password from triggering a change entry in Ansible?

Question

When ever I run my ansible playbook I always get,

TASK [set password] ****************************************************************
changed: [10.1.38.15]

As an entry in the log. I don't want that to show, as the password was already set. Is there a way for ansible to track to easily track this?

My play is

- name: set password                                                            
  run_once: true                                                                
  user:                                                                         
    name: root                                                                  
    password: "{{ 'bleh' | password_hash('sha512') }}"                      
    expires: -1

I even tried run_once which I saw others mention.

Answer 1

This is indeed what should happen. However, you do not pass the same encrypted password every time: password_hash can take a salt as a second parameter. If absent, one is generated randomly. (Salt is used to protect against pre-computed dictionary attacks, so the hash value for bleh will be different every time)

Compare:

ansible all -i localhost, -m debug -a "msg={{ 'mypassword' | password_hash('sha256') }}"

run several times, with result changing, with

ansible all -i localhost, -m debug -a "msg={{ 'mypassword' | password_hash('sha512', 'mysecretsalt') }}"

where the result stays the same because you fix the salt.