Sets the root password of a remote host to a randomly generated one. The new password gets stored locally in plaintext at /backup/passwords/<hostname>

change_root_pw.yml

---
- name: Change the root password and store the updated password locally in /backup/passwords/<hostname>
  hosts: all
  remote_user: backup

  vars:
    plaintextpw: "{{ lookup('password', '/backup/passwords/'+inventory_hostname+' chars=ascii_letters,digits,hexdigits,punctuation,, length=20') }}"

  tasks:
   - name: Remove the old password file, if it exists
     local_action: file path=/backup/passwords/{{ inventory_hostname }} state=absent

   - name: Generate the hashed password from plaintextpw
     local_action: command /usr/bin/mkpasswd --method=SHA-512 {{ plaintextpw }} 
     register: mkpasswd_output

   - name: Change the root user's password
     user: name=root
           password={{ mkpasswd_output.stdout }}
           update_password=always