python - 无法使用可靠的用户模块为用户分配密码

Question

- name: Add new SFTP user (user provided by prompt)'
  hosts: '{{ target }}'
  vars:
    pwd_alias: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') }}"
    user_to_add: "{{ newuser }}"
  tasks:
    - set_fact:
        my_pass: "{{ pwd_alias | password_hash('sha512') }}"
    - name: Create user
      user:
        name: "{{ user_to_add }}"
        password: "{{ my_pass }}"
        shell: /bin/bash
        create_home: yes
        home: "/home/sftp/{{ user_to_add }}"
        group: cgred
    - debug:
        msg: "{{ pwd_alias }},{{ my_pass }}"

当我运行它时，它会执行它应该执行的操作。它创建我指定的用户和主目录。它还会打印出密码和哈希值，但无论我做什么，我都无法将更改记录到该用户。

如有任何关于如何正确为该用户分配密码的建议，我们将不胜感激。

Answer 1

问题是 pwd_alias 放入 vars 时，每次引用时都会进行计算。比如下图

  vars:
    pwd_alias: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') }}"
  tasks:
    - debug: var=pwd_alias
    - debug: var=pwd_alias
    - debug: var=pwd_alias

给予

"pwd_alias": "RrhCtAFEHievoTY"
"pwd_alias": "TxHCsdKlpweqVJL"
"pwd_alias": "xbFLVvuMkkNkqIE"

解决方法很简单。将 pwd_alias 的评估放入任务中。例如

tasks:
  - set_fact:
      pwd_alias: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') }}"
  - set_fact:
      my_pass: "{{ pwd_alias | password_hash('sha512') }}"