jumpserver/jumpserver · error · RuntimeError

Password is required to become user {username}

Error message

Password is required to become user {username}

What it means

Raised in switch_user when su/sudo displayed a password prompt but no password is available (pword is None or empty). This is the host-based counterpart of the network privilege-switch check.

Source

Thrown at apps/libs/ansible/modules_utils/remote_client.py:684

        # secret when a prompt was actually observed.
        output_parts = []
        error = ''
        authentication_error = None
        password_sent = False
        try:
            channel = self.channel
            self._check_send(channel)
            self._send_command(channel, switch_cmd)
            switch_output = self._get_match_recv(
                prompt_re,
                allow_quiet=True,
                quiet_period=max(1.0, float(self.delay_time)),
            )
            output_parts.append(switch_output)

            if self.__match(prompt_re, switch_output):
                if pword is None or str(pword) == '':
                    raise RuntimeError(
                        f'Password is required to become user {username}'
                    )
                if '\r' in str(pword) or '\n' in str(pword):
                    raise ValueError(
                        'The become password cannot contain a line break'
                    )
                self._check_send(channel)
                self._send_command(channel, str(pword))
                password_sent = True
                password_output = self._get_match_recv(
                    prompt_re,
                    allow_quiet=True,
                )
                output_parts.append(password_output)
                if (
                    self.__match(prompt_re, password_output)
                    or become_auth_failure_re.search(password_output)
                ):

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Provide the become password: --ask-become-pass, ansible_become_password, or the module's become parameter.
2. Add a NOPASSWD sudoers rule for the exact command/user if passwordless escalation is intended (visudo, scoped narrowly).
3. Verify which password source the module uses and that it isn't overridden to empty.

Example fix

# before
- name: run task
  my_module:
    become: true
    become_user: appuser
# after
- name: run task
  my_module:
    become: true
    become_user: appuser
    become_password: "{{ vault_become_pass }}"

if module.params.get('become') and not module.params.get('become_password') and not module.params.get('login_password'):
    module.fail_json(msg='Become password required (no NOPASSWD sudoers detected)')

When it happens

Trigger: Running the module with become (sudo/su) against a host where the target requires a password and ansible_become_password / login_password is unset or renders to empty.

Common situations: NOPASSWD sudoers entry missing or mis-scoped; relying on SSH key auth so no password was ever provided; vaulted become password variable empty in this environment.

Related errors

• The privilege password cannot contain a line break
• Failed to capture shell state before switching user. Output:
• The become password cannot contain a line break
• Password is required for {method} privilege switching
• Password was rejected during {method} privilege switching

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/5e28963bf3150fea. Report an issue: GitHub.