CODEWITHSUNDEEP
ansiblesudo
RatDon
RatDon

Reputation: 3543

"sudo ansible-playbook" command fails even with --user option

I've a user foo which is able to do passwordless ssh to A(self) and B. The playbook requires sudo access inside which I'm escalating with become and the below command is working fine.

ansible-playbook -i ../inventory.ini --user=foo --become --become-user=root echo_playbook.yml

But the above command is part of a shell script which doesn't have permission for foo. So when I use sudo to trigger that shell script, ansible is saying host unreachable. So I tried the ansible command with sudo as shown below and same. It showed host is unreachable.

sudo ansible-playbook -i ../inventory.ini --user=foo --become --become-user=root echo_playbook.yml

I agree that sudo is escalating the ansible-playbook to root. But I'm also providing the --user to tell ansible that "foo" user needs to be used for ssh.

Basically to access the playbook I need sudo. To connect to other servers I need foo user. To execute the actions inside the playbook (commands in playbook) I need sudo again (which I am using become for).

Am I doing anything wrong? Can anybody tell me the exact command for the ansible-playbook for the above scenario where ansible-playbook needs to run as sudo ansible-playbook?

Upvotes: 0

Views: 2037

Answers (1)

erik258
erik258

Reputation: 16275

I'm not entirely clear on exactly where you're stuck. I don't think you're confused between the remote user and the local user. If the playbook works as foo, and from what you describe, I can only guess that ~foo/.ssh/id_rsa or another automatically provided key authenticates foo. But you can generate a key for any user and allow it access to the remote foo if you'd prefer. Or, you can run the playbook as another user. It's up to you. The only thing that won't work is relying on the environment or configuration of particular users and then not providing it.

the above command is part of a shell script which doesn't have permission for foo.

What I'm hearing is that:

  • a user foo can successfully run ansible job
  • a script runs (under root?) that cannot run the ansible job

If you're happy with how ansible works for the foo user, you can switch to the foo user to run the ansible:

sudo -u foo ansible-playbook ...

If the script runs as root, sudo will always succeed. Otherwise, you can configure sudo to allow one user to access another for one command or more.

Upvotes: 1

Related Questions