0

A UNIX engineer of my hosting provider told me that having Ansible installed on a server is problematic, because one can get root privileges from it.

Edited side note: Ansible is actually installed on the server and used to provision the same server and deploy an application onto localhost. It is a quite special case as there is also no jump host able to have Ansible installed.

I do not understand how that is possible. As far as I understand, Ansible is able to use the privileges of the user it is running as. If that user has root privileges, Ansible can also use those (e.g. using become). But if not, there is no way to escalate privileges.

This was different with Docker (not sure if it is still true). Being able to run Docker containers was equal to having privileged access.

Is the claim Ansible == root true? Does anyone know any sources claiming it or the opposite?

1
  • 6
    Just wait until they find out about sudo being installed on all of their servers!
    – ceejayoz
    Commented Mar 27, 2018 at 12:55

1 Answer 1

6

You're perfectly right, Ansible just works on top of ssh, and it cannot escalate privileges more than a normal ssh user. What the engineer is saying doesn't make any sense. He's clearly ignorant about the tool, and maybe he's making some wrong assumption (thinking that it works like puppet/cfengine/salt).

In fact, he talks about "installing ansible".. Well, you don't install ansible on the server you manage, as it doesn't have any agent.

You only need ansible installed on the host from which you want to run your orchestration jobs (it can also be your laptop). And this also means that you don't even need to tell him you will use ansible :)

5
  • 1
    In fact, Ansible is installed on the server. I clarified the question accordingly. I still don't see privilege escalation just by having the Ansible client installed. Agree? Do you have any sources for what you are saying? I'd love to have an official reference to hand over :-) Couldn't find anything in the Ansible docs.
    – nyi
    Commented Mar 27, 2018 at 16:59
  • 1
    Running an Ansible task as user: root or sudo: true just has it attempt to use sudo to run the task. If the current user can sudo, it'll get privileged access, just like you would via the CLI. If you can't sudo, neither can Ansible.
    – ceejayoz
    Commented Mar 27, 2018 at 17:26
  • 1
    @nyi Your problem is not the engineer. Your problem is the person who doesn't trust you and but demands arguments. It's an interpersonal issue and it hurts overall productivity.
    – kubanczyk
    Commented Mar 27, 2018 at 17:42
  • @nyi can you explain better? is the server the TARGET of the ansible playbook run or the host from which you run the orchestration jobs? Commented Mar 28, 2018 at 12:06
  • @DiegoRoccia Both. The server is the target of the ansible playbook as well as the host running ansible-playbook. That is, the target of the playbook is localhost and not a host connected via SSH.
    – nyi
    Commented Mar 28, 2018 at 19:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .