I am having trouble with configuring Ansible and sudo to allow me to SSH into a server and run a command as another user.

I have gone through the questions / answers below and the Ansible documentation here: http://docs.ansible.com/intro_inventory.html

but I still can not get it to work.

Please can someone put me on the right track.


https://stackoverflow.com/questions/24743085/ansible-ssh-as-one-user-and-sudo-as-another Ansible : using different sudo user for different hosts

I am trying to do this:

server-01                  client-01
---------                  -----------
foo      ----> ssh --->    foo
                           bar      - sudo as root user

Using Ansible, connect from: server-01 to: client-01

using the user foo and then use sudo to run a command as user bar User bar is setup to be able to run any command.

However, I am not sure where the problem is, with sudo or Ansible. I think the problem is with sudo but I am not sure where.

This ansible command works:

[foo@server-01 ~]$ **ansible client-01 -m raw -a "touch /var/tmp/testfile" --ask-sudo-pass**

sudo password:     *********  ( password for foo user ) 
client-01 | success | rc=0 >>

This one does not work:

[foo@server-01 ~]$ ansible client-01 -m raw -a "touch /etc/testfile" --ask-sudo-pass

sudo password:    *********  ( password for foo user ) 
client-01 | FAILED | rc=1 >>
touch: cannot touch `/etc/testfile': Permission denied

I have SSH authentication without a password setup between server-01 and client-01 for user foo and it works OK.

[foo@server-01 ~]$ id
uid=96(foo) gid=96(foo) groups=96(foo)
[foo@server-01 ~]$ su - foo
[foo@server-01 ~]$
[foo@server-01 ~]$
[foo@server-01 ~]$ ssh client-01
Last login: Thu Jan 15 16:32:05 2015 from server-01
[foo@client-01 ~]$

This is my setup:

server-01:  /etc/ansible/hosts
client-01 ansible_sudo=true ansible_ssh_user=foo ansible_sudo_user=bar

client-01:  /etc/sudoers
[root@client-01 ~]# cat /etc/sudoers
root          ALL=(ALL)                           ALL
bar           ALL=(ALL)                           ALL
foo           ALL=(bar) NOPASSWD:                 ALL

When on the destination server ( client-01 ) I can test sudo. I think that sudo is the part that is not working, but due to this I can not setup any of the Ansible Playbooks.

[root@client-01 ~]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
[root@client-01 ~]# su - bar
[bar@client-01 ~]$ sudo -l
[sudo] password for bar:
User bar may run the following commands on this host:
    (ALL) ALL
[bar@client-01 ~]$ sudo touch /etc/tempfile
[bar@client-01 ~]$ ls -alp /etc/tempfile
-rw-r--r-- 1 root root 0 Jan 15 17:08 /etc/tempfile
[bar@client-01 ~]$ sudo rm /etc/tempfile
[bar@client-01 ~]$ exit
[root@client-01 ~]# su - foo
[foo@client-01 ~]$ sudo -l
User foo may run the following commands on this host:
    (bar) NOPASSWD: ALL
[foo@client-01 ~]$ sudo touch /etc/tempfile
[sudo] password for foo:
Sorry, user foo is not allowed to execute '/bin/touch /etc/tempfile' as root on client-01.
[foo@client-01 ~]$ exit

Maybe this is the line that is failing:

  foo           ALL=(bar) NOPASSWD:                 ALL

I thank you for any help.

  • Can you SSH into the box normally and run both of those commands? Given the only difference is that path you're trying to touch, I'd guess it's a filesystem issue and not an ansible one.


Try replacing the (bar) in your Sudoers' file with ALL, for now, and see if that works?

  • Thanks for the quick reply. I am really sorry about the formatting of the question. This site seems dreadful for formatting. I will try and tidy it up. It looks fine when editing it though. At the moment it looks unreadable. – Stuart Jan 15 '15 at 16:58
  • No worries! You can use ctrl-k to turn text into code block, so that it preserves spacing and line breaks. – shearn89 Jan 15 '15 at 17:02
  • 1
    Thank you. I will edit the question to make it readable. – Stuart Jan 15 '15 at 17:04
  • There. My question is more readable now. Thank you. I think that problem is the sudo configuration "foo ALL=(bar) NOPASSWD: ALL" but I obtained this from two answers to questions on this site (references above). – Stuart Jan 15 '15 at 17:15
  • Excellent! I've updated my answer - your suspicion about the (bar) line is probably correct. – shearn89 Jan 15 '15 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.