Ansible: Timeout (12s) waiting for privilege escalation prompt
Ansible ran sudo and waited for a password prompt or a success marker that never came within the timeout. It is rarely a wrong password. More often sudo itself is slow because the host cannot resolve its own hostname, a login banner or sudo lecture is in the way, or become_method does not match what the host uses.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Time sudo on the host itself. Several seconds means a DNS lookup
ssh web1 'time sudo -n true'
# Make sure the host can resolve its own name
ssh web1 'hostname; getent hosts "$(hostname)"'
# If nothing comes back, add it to /etc/hosts:
# 127.0.1.1 web1
# Watch the exchange in detail
ansible web1 -m ping -b -vvvv
# Give slow hosts longer (ansible.cfg)
[defaults]
timeout = 30How to diagnose Ansible errors
Ansible errors split cleanly between transport problems (it cannot reach or authenticate to the host) and execution problems (it reached the host but the play failed). The message header tells you which: UNREACHABLE! is transport, FAILED! is execution. Transport issues are SSH issues wearing an Ansible hat and should be debugged with plain ssh first.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Run
ansible -m ping allbefore running any playbook. It isolates connectivity and privilege escalation from your task logic. - Raise verbosity progressively:
-vshows results,-vvvshows the SSH command line,-vvvvshows connection debugging. Most unreachable errors are solved at-vvv. - Use
--check --diffto see what a play would change without changing it. This turns a destructive debugging loop into a safe one. - For undefined-variable errors, dump the actual scope with a
debugtask (var: hostvars[inventory_hostname]) rather than reasoning about precedence from the docs. - Remember variable precedence order: extra vars (
-e) beat everything, role defaults lose to everything. Surprising values are nearly always a precedence surprise.
Tools worth reaching for
ansible -m pingansible-playbook --check --diffansible-lintssh -vvv
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Ansible errors
- Ansible: 'dict object' has no attribute 'stdout'The variable exists but does not have the key you asked for. Usually that's because the task…
- Ansible: 'variable' is undefinedA variable used in a playbook or template was not defined in inventory, group_vars…
- Ansible: [WARNING]: Platform linux on host web1 is using the discovered PythonAnsible had to guess which Python to run modules with on the managed host, and warns because…
- Ansible: Conditionals must have a boolean resultansible-core 2.19 rewrote templating and stopped guessing the truthiness of non-boolean…
- Ansible: ERROR! the role 'nginx' was not found inAnsible searched its role path and found no directory with that name. The search starts…
- Ansible: Failed to import the required Python library (docker) on hostModules run on the target with the interpreter Ansible discovered there, so a library…
- Ansible: Failed to set permissions on the temporary files Ansible needsThis happens with become_user set to an unprivileged account such as postgres. Ansible…
- Ansible: Host unreachableCannot connect to target host via SSH. Network issues, wrong IP, SSH not running, or key…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.