{"record":{"id":"d8d859fb1c205ec4","repo":"jumpserver/jumpserver","slug":"password-is-required-for-method-privilege-switch","errorCode":null,"errorMessage":"Password is required for {method} privilege switching","messagePattern":"Password is required for (.+?) privilege switching","errorType":"error_code","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"apps/libs/ansible/modules_utils/remote_client.py","lineNumber":539,"sourceCode":"\n        self._debug(\n            'privilege.network.start',\n            method=method,\n            command=switch_cmd,\n        )\n        self._check_send(channel)\n        self._send_command(channel, switch_cmd)\n        switch_output = self._get_match_recv(\n            su_prompt_re,\n            allow_quiet=True,\n            quiet_period=max(1.0, float(self.delay_time)),\n        )\n        prompt_seen = self.__match(su_prompt_re, switch_output)\n        result_output = switch_output\n\n        if prompt_seen:\n            if password is None or str(password) == '':\n                raise RuntimeError(\n                    f'Password is required for {method} privilege switching'\n                )\n            password = str(password)\n            if '\\r' in password or '\\n' in password:\n                raise ValueError(\n                    'The privilege password cannot contain a line break'\n                )\n            self._check_send(channel)\n            self._send_command(channel, password)\n            # The privileged prompt often differs from the login prompt\n            # (`>` becomes `#`), so allow quiet completion here.\n            password_output = self._get_match_recv(allow_quiet=True)\n            result_output += '\\n' + password_output\n            if (\n                self.__match(su_prompt_re, password_output)\n                or network_auth_failure_re.search(password_output)\n            ):\n                raise BecomeAuthenticationError(","sourceCodeStart":521,"sourceCodeEnd":557,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/libs/ansible/modules_utils/remote_client.py#L521-L557","documentation":"Raised inside _switch_network_privilege (via switch_user) when the device displayed a privilege-switch password prompt (su/enable) but no password was configured. The client detects the prompt and requires credentials to proceed.","triggerScenarios":"Calling the module with become/enable switching on a network device where the device prompts for a password and login_password (or the become password param) is None or empty string.","commonSituations":"Assuming NOPASSWD/enable-without-password on a device that actually requires one; keys used for login so login_password was never set; become password stored in a vault variable that rendered empty.","solutions":["Provide the privilege password via the module's password/become parameter (e.g. from ansible_become_password or a vaulted var).","If the device should not prompt, verify the enable/su configuration (e.g. 'enable secret' vs no password) and the become method chosen.","Confirm the correct become method is selected so an unexpected prompt isn't misinterpreted."],"exampleFix":"# before\n- name: run module\n  my_module:\n    become_method: enable\n# after\n- name: run module\n  my_module:\n    become_method: enable\n    become_password: \"{{ vault_enable_password }}\"","handlingStrategy":"validation","validationCode":"if become and not (module.params.get('login_password') or module.params.get('become_password')):\n    module.fail_json(msg='Privilege switching requires a password on this device')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Test enable/su interactively to learn whether a password is prompted.","Vault the privilege password and pass it explicitly.","Don't assume key-based login removes the need for an enable password."],"tags":["ansible","network","become","privilege","authentication"],"backgroundTag":"privilege-escalation-password-required","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}