1

I want to manage a bunch of devices running /bin/rbash as the default shell with Ansible.

The problem is that Ansible always tries to execute a list of commands that rbash doesn't like at all:

umask 77 && mkdir -p \"` echo ./ansible-tmp-1460362654.19-62671997084808 `\" && echo \"` echo ./ansible-tmp-1460362654.19-62671997084808 `\"

Any ideas how can I avoid this commands?

To clarify: I want to change the shell Ansible uses, and there is only one user available.

4
  • Don't use rbash or any other restricted shell, or you're going to have a bad time. Log in to another account which doesn't use a restricted shell. Apr 11, 2016 at 8:24
  • The problem is that the devices already have rbash, because someone found that useful. Now, I want to change that with Ansible. Apr 11, 2016 at 8:26
  • Try logging in as root, that is going to be your last resort. Apr 11, 2016 at 8:27
  • The root user is not available. If I login I can change the shell but Ansible execute those commands and rbash doesn't like them Apr 11, 2016 at 8:34

1 Answer 1

8

Hmm. I think you can get around this with ansible's raw module.

Remember that while rbash is a restricted shell, it's entirely possible to start an unrestricted subshell; it's meant more to prevent accidents than to provide security.

So this is what I would do. I've tested this and confirmed it successfully changes a restricted shell. Note that it has to prompt for a password, because chsh prompts for a password and this isn't avoidable without root access.

---
- hosts: all
  gather_facts: False
  remote_user: username
  tasks:
    - name: change shell
      raw: "bash -c 'chsh -s /bin/bash' <<< '{{chsh_password}}' "
  vars_prompt:
    - name: "chsh_password"
      prompt: "Password"
1
  • The problem is that rbash does not like use /bin/rbash for running commands so for example, you cannot run /bin/rbash -c echo hi. I modify executable in ansible.cfg to run rbash instead of /bin/sh so now Ansible run rbash -c echo hi and not /bin/sh -c echo hi or /bin/rbash -c echo hi. And now, with your playbook everything works! :D thanks!!! Apr 11, 2016 at 10:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .