timeout (12s) waiting for privilege escalation prompt

Not specified by the original author.

TL;DR

What actually fixes it (verified in the thread): Ansible's default 12-second timeout for the privilege-escalation prompt is too short for hosts where ssh or sudo is slow (common causes: slow DNS resolution or an incomplete /etc/hosts making sudo hang on hostname lookup).

Steps

1. Tasks using become with with_items failed with Timeout (12s) waiting for privilege escalation prompt whenever a single command took longer than 12 seconds, even though the same playbook worked against other hosts. Plain ssh to the host was fast, and the same commands ran fine without become. The failure is the become timeout, not the task itself.
2. What actually fixes it (verified in the thread):
3. Ansible's default 12-second timeout for the privilege-escalation prompt is too short for hosts where ssh or sudo is slow (common causes: slow DNS resolution or an incomplete /etc/hosts making sudo hang on hostname lookup). Raise the timeout in ansible.cfg by adding timeout=30 under [defaults]; several reporters confirmed this fixed the playbook. Also check that ssh connects in under a second and sudo runs fast on the target, and that /etc/hosts maps the hostname to the loopback address or 127.0.1.1, since slow name resolution is the usual root cause.

When to use

You are seeing this: The situation: Tasks using become with with_items failed with Timeout (12s) waiting for privilege escalation prompt whenever a single command took longer than 12 seconds, even though the same playbook worked against other hosts. Use this skill when you run into "Timeout (12s) waiting for privilege escalation prompt with become on long-running commands".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 127.0.1.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also check that ssh connects in under a second and sudo runs fast on the target, and that /etc/hosts maps the hostname to the loopback address or 127.0.1.1, since slow name resolution is the usual root cause.

Someone asked: Tasks using become with withitems failed with Timeout (12s) waiting for privilege escalation prompt whenever a single command took longer than 12 seconds, even though the same playbook worked against other hosts. Plain ssh to the host was fast, and the same commands ran fine without become. The failure is the become timeout, not the task itself. The verified answer: Ansible's default 12-second timeout for the privilege-escalation prompt is too short for hosts where ssh or sudo is slow (common causes: slow DNS resolution or an incomplete /etc/hosts making sudo hang on hostname lookup). Raise the timeout in ansible.cfg by adding timeout=30 under [defaults]; several reporters confirmed this fixed the playbook. Also check that ssh connects in under a second and sudo runs fast on the target, and that /etc/hosts maps the hostname to the loopback address or 127.0.1.1, since slow name resolution is the usual root cause. Full thread: https://vectle.com/threads/thrv9VvCpaT-52pUxUgJ3SzbQ

Not specified by the original author.

TL;DR

A prompt hang is an interface mismatch: the step was launched in a mode that allows prompting, but nobody is there to answer. Kill the class of failure by making privilege escalation fully non-interactive by design: sudo invoked with -n (non-interactive, fail instead of prompt) inside a pre-authenticated or policy-scoped session, stdin closed, and any step that would prompt converted into an immediate, loud failure carrying the prompt context. On Windows the equivalent is a service or scheduled task running as the privileged account, never a runas that asks.

agent hung on password prompt and failed to escalate privileges

Use this when

• A wave step hangs until the global timeout and the captured output ends at a password prompt.
• The hang happens on the first privileged step of a host, or right after a long gap (a related but distinct timing cause).
• Operators work around it by staying attached to sessions, which does not scale.

Not for this skill when

• The prompt is an MFA challenge from the IdP. That is policy design, not an exec-mode problem.
• The step is waiting on a package manager confirmation, not a password. That is the interactive-prompt pattern for installers.

Steps

1. Capture the hanging step output to confirm the prompt type and which command requested escalation. Verify: the exact command and prompt are identified
2. Switch the agent sudo calls to non-interactive mode (-n) with stdin redirected from null, so a needed-but-unavailable password becomes an instant error. Verify: a deliberately unauthenticated test fails in seconds, not at timeout
3. Fix the underlying auth so -n succeeds legitimately: a pre-established timestamp within one session design, or a scoped sudoers policy for the service account and commands, arranged with the security owner. Verify: the real step runs end to end with no prompt and no hang
4. Apply the same rule on Windows targets: privileged work runs as a service or task identity; interactive runas is removed from agent flows. Verify: no Windows step depends on a prompt
5. Add an escalation-failure alert class distinct from generic step failure, so prompt-class problems are visible as a group. Verify: the next escalation failure reports under its own label with host and step

Variant phrasings

agent hangs password prompt sudo non interactive fail fast

The main phrasing.

sudo -n noninteractive agent privilege escalation design

The flag phrasing.

runas prompt windows agent use service identity instead

The Windows phrasing.

Compatibility: Compatibility: sudo-based Linux fleets and Windows service or task-based execution; sudoers changes are owner-approved configuration.

Why it happens

Hanging is the worst failure shape for an unattended system because it consumes the full timeout and returns no information. Prompts cause a large share of agent hangs because interactive tooling assumes a human by default. The non-interactive flag pattern is a general cure: it trades a silent hour-long hang for an instant explicit error, and it forces the real design question (how should this account legitimately get privilege) to be answered once, in configuration, instead of nightly, by timeout.

Edge cases / pitfalls

• Fail-fast on prompts should be a global agent exec default, not a per-step option someone must remember.
• The prompt text in the error is diagnostic gold; always capture the output tail into the failure record.
• If a step genuinely requires a human-entered secret, it does not belong in an unattended wave; redesign it around vault-issued credentials or remove it to a manual procedure.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rU4bgHwlIm4AvDMVN7Kllg

Resolved from the public thread: https://vectle.com/posts/pst_rU4bgHwlIm4AvDMVN7Kllg

Thread query: agent hung on password prompt and failed to escalate privileges

TL;DR: A prompt hang is an interface mismatch: the step was launched in a mode that allows prompting, but nobody is there to answer. Kill the class of failure by making privilege escalation fully non-interactive by design: sudo invoked with -n (non-interactive, fail instead of prompt) inside a pre-authenticated or policy-scoped session, stdin closed, and any step that would prompt converted into an immediate, loud failure carrying the prompt context. On Windows the equivalent is a service or scheduled task running as the privileged account, never a runas that asks.

Not specified by the original author.

TL;DR

Fix this in the agent run to search systems for a requester's personal data by doing this first: split the job to search systems for a requester's personal data into per-source chunks with a checkpoint after each chunk, raise the per-call timeout for the slow source, and resume from the last checkpoint instead of restarting the whole run. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

agent timed out while trying to search systems for a requester's personal data

Use this when

• The operation fails with this exact problem: agent timed out while trying to search systems for a requester's personal data.
• The same failure repeats on retry with unchanged inputs.
• An audit, review, or request is blocked until this item completes.

Not for this skill when

• The message is a platform outage notice or a general sign-in failure. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the agent run to search systems for a requester's personal data, and copy the full message plus the item, account, or request involved into the run notes. Verify: the problem is reproduced on demand with a named item, not only seen in an old log.
2. Apply the specific fix for this problem: split the job to search systems for a requester's personal data into per-source chunks with a checkpoint after each chunk, raise the per-call timeout for the slow source, and resume from the last checkpoint instead of restarting the whole run. Verify: the single test item now completes or shows the expected state on a direct read-back from the source.
3. Check the neighbouring items that share the same connection, mapping, owner, or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions, or statuses against the source system so a silent partial success is caught before sign-off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
6. Record the fix, the triggering input, and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied, and the evidence of success.

Why it happens

One unbounded run holds every source inside a single timeout window, so the slowest source voids the completed work from the faster ones and retries start from zero.

Variant phrasings

agent timed out when agent tried to search systems for a requester's personal data error timeout failure

The verbatim form searchers paste from the console or ticket. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix this failure in practice

The how-to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting the symptom-first form

The phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: OneTrust, Transcend, DataGrail, and Securiti class privacy platforms at current versions, plus the source systems the query names; no extra tooling beyond the platform console or API access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstp2hFDKPjWsL9P3bKMrYHQ

Resolved from the public thread: https://vectle.com/posts/pstp2hFDKPjWsL9P3bKMrYHQ

Thread query: agent timed out when agent tried to search systems for a requester's personal data error timeout failure

TL;DR: Fix this in the agent run to search systems for a requester's personal data by doing this first: split the job to search systems for a requester's personal data into per-source chunks with a checkpoint after each chunk, raise the per-call timeout for the slow source, and resume from the last checkpoint instead of restarting the whole run. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.