3

I have to administer some half-managed servers (monstly CentOS 6), where we are only allowed to login as a regular user, then do "sudo su -" and type the regular user password, and then run the commands within the root shell. I have been searching how to do this with some configuration management tools (ansible, capistrano, etc.), but haven't found anything. Any experience with a similar situation? I have to say we are NOT able/allowed to change the allowed sudo commands, so it's mandatory that the tools use "sudo su -" and the run the appropiate commands. Also, we are not allowed to install any software in the machines (yes, it is a very restrictive client), so all commands must be run using ssh and password authentication.

Regards and thanks in advance.

Improve this question
10
  • 3
    So you can't modify what commands you can use with sudo, but sudo su is allowed? What?
    – MDMarra
    Jan 2, 2015 at 20:54
  • Yes, we have root permissions using sudo su -, but we are not allowed to do any substantial change in the systems, just verify the services are working, apply some patches, etc.
    – okelet
    Jan 2, 2015 at 21:00
  • 1
    Can you at least put a wrapper script that you can run with ansible's sudo_exe option and convert the execution to sudo su - -c ... (exercise for the reader: handle all the options ansible might use on sudo) or no changes to the server at all?
    – DerfK
    Jan 2, 2015 at 21:18
  • It looks like the playbooks for ansible support destination users in sudo
    – Aaron
    Jan 2, 2015 at 21:24
  • please share the relevant section of your /etc/sudoers.
    – 300D7309EF17
    Jan 2, 2015 at 21:29

2 Answers 2

Reset to default
2

Change privilage escalation in ansible.cfg:

[privilege_escalation]
become_exe='sudo su -'

Documentation here

Improve this answer
0

If you have sudo, you can use Fabric for code deployments (and use it to hook into git), installing and removing software (though I guess you won't need that functionality), create/remove users, and other uses like that. It's not as feature rich as configuration management software like Puppet, but you can get a lot done with it, and it's reasonably quick and easy to learn.

Improve this answer
1
  • 2
    The OP doesn't have sudo but sudo su -. The latter is a a major PITA for automation, appearantly internal rules prohibit from changing that setting (even if it would be technically possible)
    – serverhorror
    Jan 13, 2015 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .