Ansible Users, Groups and Password Hashes
Creating a user is one module and the parameters are obvious. The password is not: the `password` parameter takes a **hash**, and passing a plain string writes that string into the shadow file as though it were one. Nothing fails, and the account is unusable. This shows the trap, the fix, and the rest of the lifecycle.
Automating Administration Guide 31 of 45 Intermediate
- OSUbuntu 26.04 LTS
- ansible-core2.20.1
- Python3.14.4
- TimeAbout 16 min
- Reviewed23 August 2026
Written against the versions above. This lab is Ubuntu 26.04 and EX294 is a RHEL exam. the `user` and `group` modules are identical on both. `password_hash('sha512')` needs `passlib` on the control node for some algorithms; sha512 works with the standard library. The salt argument makes the hash deterministic, which is what keeps the task idempotent - without it a new hash is generated every run and the task reports change forever.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| ANS-CTL01 | 192.168.0.36 | Ubuntu 26.04 LTS | Ansible Control Node | 2 Core | 3 GB | 50 GB |
| ANS-A01 | 192.168.0.37 | Ubuntu 26.04 LTS | Managed Node (group: web) | 2 Core | 3 GB | 50 GB |
Before you start
- A control node configured as shown in the first step.
- The session creates users
aliceandboband groupsdevelopersanddeployers, then removes all four.
-
The configuration this guide assumes
-
Groups first, then users
-
The password trap
-
Hashing it properly
-
Keys, locking and removal