CODEWITHSUNDEEP
ansiblesudo
azmeuk
azmeuk

Reputation: 4496

Ansible sudo command without password checking

I would like to use ansible in a full automated context, where I cannot manually type passwords. To deal with this, I connect the servers with SSH public key, and I whitelisted severals commands such as apt-get install * in my sudoers configuration so I do not need a password to run them. For instance sudo apt-get install git.

However if the setting become is True in a playbook, ansible asks me for a password it does not need.

sudoers conf

myuser ALL = NOPASSWD: /usr/bin/apt-get install *

ansible

- name: install the latest version of ntpdate
  package:
    name: ntpdate
    state: latest
  become: True

Produces this output:

failed: [x.x.x.x] (item=ntpdate) => {"failed": true, "item": "python3-dev", "module_stderr": "", "module_stdout": "sudo: a password is required\r\n", "msg": "MODULE FAILURE", "rc": 1}

Upvotes: 4

Views: 8926

Answers (5)

user2431672
user2431672

Reputation: 11

You can use the ansible 'command' module with sudo as part of the command, instead of 'become: yes'

- name: install the latest version of ntpdate
  command: 'sudo apt-get update ntpdate'

The downside is that this is much less portable. The upside is, it works... and you only need to whitelist the specific command.

Upvotes: 1

Antoine Boucher
Antoine Boucher

Reputation: 85

template/without_sudo

%sudo  ALL=(ALL) NOPASSWD: ALL
%sudo  ALL=(ALL) NOPASSWD: /sbin/poweroff, /sbin/reboot, /sbin/shutdown

tasks/main.yml

- name: Sudoers no password
  raw: echo '{{ user_password }}' | sudo -S sh -c 'echo "{{ lookup('file', 'templates/without_sudo') }}" > /etc/sudoers.d/without_sudo'

no sudo for the rest of the ansible command

Upvotes: 1

utpalendu chakrobortty
utpalendu chakrobortty

Reputation: 1

in my opinion, if you set your node with =(ALL) NOPASSWD:ALL. then anybody: including the hackers can access your nodes.

so what I can suggest ,

ansible-playbook <name>.yml --ask-sudo-pass

this will ask your node sudo password. and u can execute ur operation, as I guess you know ur node's credential.

Upvotes: -1

techraf
techraf

Reputation: 68449

The simple answer is that you cannot do it without enabling all commands (or at least python).

Ansible does not run the commands as you expect it to run. It runs Python scripts. You can see the exact command when you execute ansible-playbook with -vvv. They are much more complex and to enable them you would have to add them to sudoers, for example:

sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-xxxxxx;
  /usr/bin/python /var/www/.ansible/tmp/ansible-tmp-xxxxxxxx/apt.py;
  rm -rf "/var/www/.ansible/tmp/ansible-tmp-xxxxxxxx/" > /dev/null 2>&1'"'"'
  && sleep 0

The tricky part is that all spaces, quotes, and other special characters are relevant and until you get the correct command pattern by trial and error, replacing characters with wildcards, the system will not allow the command to run with elevated privileges. Effectively you won't be able to whitelist all the commands Ansible runs.

The only exception is raw module which runs the given command intact.

Upvotes: 2

Tejaswi
Tejaswi

Reputation: 264

In all the Ansible playbooks I have worked on, I had to do only 2 things so that tasks run with become:True

  1. Create file /etc/sudoers.d/demo on the target hosts with below content:

    demo ALL=(ALL) NOPASSWD:ALL

  2. Copy ssh id from Ansible host to target host using ssh-copy-id

Upvotes: 1

Related Questions