Repository: ansible/ansible

Issue:
unable to elevate privilege to enable mode on Cisco 6504
##### ISSUE TYPE

 - Bug Report
 ##### COMPONENT NAME
lib/ansible/plugins/terminal/ios.py

##### ANSIBLE VERSION
ansible 2.5.0rc3
  config file = /home/user/ycaty/ansible.cfg
  configured module search path = [u'/usr/lib/python2.7/site-packages/ansible/modules/scp_sidecar/ansible_modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Nov  6 2016, 00:28:07) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]

##### OS / ENVIRONMENT
Cisco WS-C6504-E-Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI9, RELEASE SOFTWARE (fc2)
Centos7 machine

##### SUMMARY
Getting below error when running a playbook on cisco ios to retrive the configuration:
```
fatal: [Sw-1A]: FAILED! => {
"msg": "unable to elevate privilege to enable mode, at prompt [\SW-1A>] with error: enable\r\nLocal_Password:\r\n% Local_Password: timeout expired!\r\n% Error in authentication.\r\n\r\nSW-1A>"
}
```
##### STEPS TO REPRODUCE
Playbook snippet:
```
hosts: IOCore
gather_facts: True
connection: local

tasks:

name: RETRIEVE CONFIGURATION FILE
ios_command:
commands:

show running-config
host: "{{ ansible_host }}"
username: "{{ ansible_user }}"
password: "{{ ansible_ssh_pass }}"
auth_pass: "{{ ansible_auth_pass }}"
authorize: "{{ ansible_authorize }}"
timeout: 60
register: config
name: SAVE OUTPUT
copy:
content: "{{ config.stdout[0] }}"
dest: "/home/ycaty/configurations/Config.conf"
```

##### EXPECTED RESULTS
The playbook should retrieve the configuration successfully and store it at the mentioned location

##### ACTUAL RESULTS
Log:

2018-03-16 09:00:38,260 p=22395 u=root | PLAY RECAP *************************************************************************************************************************************************************
2018-03-16 09:00:38,260 p=22395 u=root | SW-1A : ok=1 changed=0 unreachable=0 failed=1
2018-03-16 09:00:38,299 paramiko.transport EOF in transport thread
2018-03-16 09:56:18,629 p=23015 u=root | ansible-playbook 2.5.0rc3
config file = /home/user/ytcaty/ansible.cfg
configured module search path = [u'/usr/lib/python2.7/site-packages/ansible/modules/scp_sidecar/ansible_modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /bin/ansible-playbook
python version = 2.7.5 (default, Nov 6 2016, 00:28:07) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]
2018-03-16 09:56:18,629 p=23015 u=root | Using /home/user/ytcaty/ansible.cfg as config file
2018-03-16 09:56:18,629 p=23015 u=root | setting up inventory plugins
2018-03-16 09:56:18,658 p=23015 u=root | Parsed /home/user/ytcaty/hosts inventory source with ini plugin
2018-03-16 09:56:18,734 p=23015 u=root | Loading callback plugin default of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callback/default.pyc
2018-03-16 09:56:18,832 p=23015 u=root | PLAYBOOK: IOCoreSwitch_GetRunningConfig.yml ****************************************************************************************************************************
2018-03-16 09:56:18,832 p=23015 u=root | 1 plays in IOCoreSwitch_GetRunningConfig.yml
2018-03-16 09:56:18,868 p=23015 u=root | PLAY [IOCore] **********************************************************************************************************************************************************
2018-03-16 09:56:18,878 p=23015 u=root | TASK [Gathering Facts] *************************************************************************************************************************************************
2018-03-16 09:56:18,879 p=23015 u=root | task path: /home/user/ytcaty/IOCoreSwitch_GetRunningConfig.yml:9
2018-03-16 09:56:19,177 p=23015 u=root | Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/setup.py
2018-03-16 09:56:19,535 p=23015 u=root | ok: [SW-1A]
2018-03-16 09:56:19,536 p=23015 u=root | META: ran handlers
2018-03-16 09:56:19,549 p=23015 u=root | TASK [RETRIEVE CONFIGURATION FILE] *************************************************************************************************************************************
2018-03-16 09:56:19,549 p=23015 u=root | task path: /home/user/ytcaty/IOCoreSwitch_GetRunningConfig.yml:14
2018-03-16 09:56:20,204 paramiko.transport starting thread (client mode): 0x2452550L
2018-03-16 09:56:20,204 paramiko.transport Local version/idstring: SSH-2.0-paramiko_2.4.1
2018-03-16 09:56:20,204 paramiko.transport Remote version/idstring: SSH-1.99-Cisco-1.25
2018-03-16 09:56:20,204 paramiko.transport Connected (version 1.99, client Cisco-1.25)
2018-03-16 09:56:20,205 paramiko.transport kex algos:[u'diffie-hellman-group1-sha1'] server key:[u'ssh-rsa'] client encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] server encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] client mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] server mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] client compress:[u'none'] server compress:[u'none'] client lang:[u''] server lang:[u''] kex follows?False
2018-03-16 09:56:20,205 paramiko.transport Kex agreed: diffie-hellman-group1-sha1
2018-03-16 09:56:20,205 paramiko.transport HostKey agreed: ssh-rsa
2018-03-16 09:56:20,205 paramiko.transport Cipher agreed: aes128-cbc
2018-03-16 09:56:20,206 paramiko.transport MAC agreed: hmac-sha1
2018-03-16 09:56:20,206 paramiko.transport Compression agreed: none
2018-03-16 09:56:20,742 paramiko.transport kex engine KexGroup1 specified hash_algo 
2018-03-16 09:56:20,742 paramiko.transport Switch to new keys ...
2018-03-16 09:56:20,941 paramiko.transport userauth is OK
2018-03-16 09:56:25,941 paramiko.transport Authentication (password) successful!
2018-03-16 09:56:25,977 paramiko.transport [chan 0] Max packet in: 32768 bytes
2018-03-16 09:56:25,978 paramiko.transport [chan 0] Max packet out: 4096 bytes
2018-03-16 09:56:25,979 paramiko.transport Secsh channel 0 opened.
2018-03-16 09:56:25,979 paramiko.transport [chan 0] Sesch channel 0 request ok
2018-03-16 09:56:25,980 paramiko.transport [chan 0] Sesch channel 0 request ok
2018-03-16 09:57:01,777 p=23082 u=root | shutdown complete
2018-03-16 09:57:01,807 p=23015 u=root | The full traceback is:
Traceback (most recent call last):
File "/bin/ansible-connection", line 70, in start
self.connection._connect()
File "/usr/lib/python2.7/site-packages/ansible/plugins/connection/network_cli.py", line 323, in _connect
self._terminal.on_become(passwd=auth_pass)
File "/usr/lib/python2.7/site-packages/ansible/plugins/terminal/ios.py", line 77, in on_become
raise AnsibleConnectionFailure('unable to elevate privilege to enable mode, at prompt [%s] with error: %s' % (prompt, e.message))
AnsibleConnectionFailure: unable to elevate privilege to enable mode, at prompt [
SW-1A>] with error: enable^M
Local_Password:^M
% Local_Password: timeout expired!^M
% Error in authentication.^M
^M
SW-1A>

2018-03-16 09:57:01,810 p=23015 u=root | fatal: [SW-1A]: FAILED! => {
"msg": "unable to elevate privilege to enable mode, at prompt [\nSW-1A>] with error: enable\r\nLocal_Password:\r\n% Local_Password: timeout expired!\r\n% Error in authentication.\r\n\r\nSW-1A>"
}
2018-03-16 09:57:01,811 p=23015 u=root | to retry, use: --limit @/home/user/ytcaty/IOCoreSwitch_GetRunningConfig.retry

2018-03-16 09:57:01,811 p=23015 u=root | PLAY RECAP *************************************************************************************************************************************************************
2018-03-16 09:57:01,811 p=23015 u=root | SW-1A : ok=1 changed=0 unreachable=0 failed=1
2018-03-16 09:57:01,839 paramiko.transport EOF in transport thread
~


ansible.cfg details:

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False

[presistent_connection]
command_timeout=60

I can successfully login to the switch with enable password
The switch login details:
login as: local
Using keyboard-interactive authentication.
Local_Password:

SW-1A>enable
Local_Password:
SW-1A#
:
Can someone please help!



Discussion:
(for the pr bot)
!component=lib/ansible/plugins/terminal/ios.py
pinging @Qalthos @ganeshrn @gundalow @privateip @rcarrillocruz @trishnaguha @kedarX @gdpak

Resolving patch:
diff --git a/lib/ansible/plugins/terminal/ios.py b/lib/ansible/plugins/terminal/ios.py
--- a/lib/ansible/plugins/terminal/ios.py
+++ b/lib/ansible/plugins/terminal/ios.py
@@ -65,7 +65,7 @@ def on_become(self, passwd=None):
         if passwd:
             # Note: python-3.5 cannot combine u"" and r"" together.  Thus make
             # an r string and use to_text to ensure it's text on both py2 and py3.
-            cmd[u'prompt'] = to_text(r"[\r\n]password: ?$", errors='surrogate_or_strict')
+            cmd[u'prompt'] = to_text(r"[\r\n](?:Local_)?[Pp]assword: ?$", errors='surrogate_or_strict')
             cmd[u'answer'] = passwd
             cmd[u'prompt_retry_check'] = True
         try:


Test patch: