Ansible Users, Groups and Password Hashes

Automating Administration / Guide 31 of 45 / Intermediate

• OSUbuntu 26.04 LTS
• ansible-core2.20.1
• Python3.14.4
• TimeAbout 16 min

This lab is Ubuntu 26.04 and EX294 is a RHEL exam. the user and group modules are identical on both. password_hash('sha512') needs passlib on the control node for some algorithms; sha512 works with the standard library. The salt argument makes the hash deterministic, which is what keeps the task idempotent - without it a new hash is generated every run and the task reports change forever.

This guide includes

Use this when creating users with the user module. This matters because the password parameter takes a hash rather than a password - passing plaintext succeeds and leaves an account nobody can log into.

• creating groups first, then the users that belong to them
• hitting the password trap, where the obvious parameter does the wrong thing
• hashing it properly with password_hash
• handling keys, locking and removal - since a key beats a password for a service account

Before you start

• A control node configured as shown in the first step.
• The session creates users alice and bob and groups developers and deployers, then removes all four.

1. 1

   The configuration this guide assumes

2. 2

   Groups first, then users

3. 3

   The password trap

4. 4

   Hashing it properly

5. 5

   Keys, locking and removal

Official sources

• ansible.builtin.user
• How do I generate encrypted passwords
• ansible.builtin.group