{"record":{"id":"5e28963bf3150fea","repo":"jumpserver/jumpserver","slug":"password-is-required-to-become-user-username","errorCode":null,"errorMessage":"Password is required to become user {username}","messagePattern":"Password is required to become user (.+?)","errorType":"error_code","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"apps/libs/ansible/modules_utils/remote_client.py","lineNumber":684,"sourceCode":"        # secret when a prompt was actually observed.\n        output_parts = []\n        error = ''\n        authentication_error = None\n        password_sent = False\n        try:\n            channel = self.channel\n            self._check_send(channel)\n            self._send_command(channel, switch_cmd)\n            switch_output = self._get_match_recv(\n                prompt_re,\n                allow_quiet=True,\n                quiet_period=max(1.0, float(self.delay_time)),\n            )\n            output_parts.append(switch_output)\n\n            if self.__match(prompt_re, switch_output):\n                if pword is None or str(pword) == '':\n                    raise RuntimeError(\n                        f'Password is required to become user {username}'\n                    )\n                if '\\r' in str(pword) or '\\n' in str(pword):\n                    raise ValueError(\n                        'The become password cannot contain a line break'\n                    )\n                self._check_send(channel)\n                self._send_command(channel, str(pword))\n                password_sent = True\n                password_output = self._get_match_recv(\n                    prompt_re,\n                    allow_quiet=True,\n                )\n                output_parts.append(password_output)\n                if (\n                    self.__match(prompt_re, password_output)\n                    or become_auth_failure_re.search(password_output)\n                ):","sourceCodeStart":666,"sourceCodeEnd":702,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/libs/ansible/modules_utils/remote_client.py#L666-L702","documentation":"Raised in switch_user when su/sudo displayed a password prompt but no password is available (pword is None or empty). This is the host-based counterpart of the network privilege-switch check.","triggerScenarios":"Running the module with become (sudo/su) against a host where the target requires a password and ansible_become_password / login_password is unset or renders to empty.","commonSituations":"NOPASSWD sudoers entry missing or mis-scoped; relying on SSH key auth so no password was ever provided; vaulted become password variable empty in this environment.","solutions":["Provide the become password: --ask-become-pass, ansible_become_password, or the module's become parameter.","Add a NOPASSWD sudoers rule for the exact command/user if passwordless escalation is intended (visudo, scoped narrowly).","Verify which password source the module uses and that it isn't overridden to empty."],"exampleFix":"# before\n- name: run task\n  my_module:\n    become: true\n    become_user: appuser\n# after\n- name: run task\n  my_module:\n    become: true\n    become_user: appuser\n    become_password: \"{{ vault_become_pass }}\"","handlingStrategy":"validation","validationCode":"if module.params.get('become') and not module.params.get('become_password') and not module.params.get('login_password'):\n    module.fail_json(msg='Become password required (no NOPASSWD sudoers detected)')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass ansible_become_password or use --ask-become-pass.","Configure narrowly-scoped NOPASSWD sudoers if passwordless is intended.","Verify with sudo -n true -u <user> before the run."],"tags":["ansible","become","sudo","su","password"],"backgroundTag":"privilege-escalation-password-required","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}