Ansible host:
CentOS 6( 2.6.32-754.35.1.el6.x86_64)
Python version 2.6
Ansible version 2.6
Test virtual machine:
CentOS 7 (CentOS Linux release 7.9.2009 (Core) 3.10.0-1160.11.1.el7.x86_64)
Python 2.7.5
how I added the user to the test server:
groupadd -g 590 www
groupadd -g 591 playbookuser
adduser -u 690 -g 591 playbookuser
usermod -a -G www playbookuser
mkdir -p /home/playbookuser/.ssh/
echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAA==">> /home/playbookuser/.ssh/authorized_keys
chmod 600 /home/playbookuser/.ssh/authorized_keys
chown -R playbookuser.playbookuser /home/playbookuser/
In /etc/sudoers addet "playbookuser ALL=(ALL) NOPASSWD:ALL"
then I create and run playbook:
---
- hosts: all
become: yes
become_method: sudo
gather_facts: no
tasks:
- name: backup sshd config
copy:
src: /etc/ssh/sshd_config
dest: /etc/ssh/sshd_config.bak
backup: yes
Ansible connects by ssh to the test machine and executes commands from the user playbookuser
Then the playbook will not work, what is the problem please tell me ?
PS. if you run the same command from the user in the console with the sudo prefix , then everything is ok.
but I get this error:
MSG:
an error occurred while trying to read the file '/etc/ssh/sshd_config': [Errno 13] Permission denied: '/etc/ssh/sshd_config'
to retry, use: --limit #/var/lib/****/workspace/test_adm_deploy/174/backup_sshd%20_config.retry
The answer to this is listed in a comment.
remote_src: yes
Should be added.
backup: yes
Should be removed.
Related
I'm a beginner with Ansible, and I need to run some basic tasks on a remote server.
The procedure is as follows:
I log as some user (osadmin)
I run su - to become root
I then do the tasks I need to.
So, I wrote my playbook as follows:
---
- hosts: qualif
vars:
- ansible_user: osadmin
- ansible_password: H1g2.D6#
tasks:
- name: Copy stuff from here to over there
copy:
src: /home/osadmin/file.txt
dest: /home/osadmin/file-changed.txt
owner: osadmin
group: osadmin
mode: 0777
Also, I have the following in vars/main.yml:
ansible_user: osadmin
ansible_password: password1
ansible_become_password: password2
[ some other values ]
However, when running my tasks, Ansible / the hosts returns me the following:
"Incorrect sudo password"
I then changed my tasks so that instead of becoming sudo and copy the file in some place my osadmin doesn't have access, I just copy the file on /home/osadmin. So, theorically, no need to become sudo for just a simple copy.
The problem now is that not only it keeps saying "wrong sudo password", but if I remove it, Ansible asks for it.
I then decided to run the command and added -vvv at the end, and it showed me the following:
ESTABLISH SSH CONNECTION FOR USER: osadmin
SSH: EXEC sshpass -d10 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=osadmin -o ConnectTimeout=10 -o ControlPath=/home/osadmin/.ansible/cp/b9489e2193 -tt HOST-ADDRESS '/bin/sh -c '"'"'sudo -H -S -n -u
root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-ewujwywrqhcqfdrkaglvrouhmuiefwlj; /usr/bin/python /home/osadmin/.ansible/tmp/ansible-tmp-1550076004.1888492-11284794413477/AnsiballZ_setup.py'"'"'"'"'"'"'"'"' && sleep 0'"'"''
(1, b'sudo: a password is required\r\n', b'Shared connection to HOST-ADDRESS closed.\r\n')
As you can see, it somehow uses root, while I never told him to.
Does anyone know why Ansible keeps trying to be sudo, and how can I disable this?
Thank you in advance
There is a difference between 'su' and 'sudo'. If you have 'su' access, that means, that you can log as root (may be not, but it looks like). Use ansible_ssh_user=root, ansible_password=password2.
If this doesn't work, try to configure sudo on a server. You should be able to run sudo whoami and to get answer root. After that your code should run.
One more thing: you are using 'copy' module incorrectly. It uses src as path on local machine (where ansible is run), and dst as path on remote machine.
I login to server (CentOs 7) as my user and execute double sudo to become root. No password is required at such times.
Command: sudo sudo su
I need to install applications on such server as root user using Ansible (2.7)
Unfortunately, when i try following it gives: ""msg": "Timeout (12s) waiting for privilege escalation prompt: ""
---
- name: Copy file
become: true
become_method: su
hosts: all
tasks:
- name: Copy file
copy:
src: abc.txt
dest: /tmp/
I have tried other versions like changing become_method to sudo, etc. But they don't work. Any suggestion will help?
When running my script I keep getting "ERROR! the field 'hosts' is required but was not set". Can anyone please tell me what it is that I am missing. I am currently trying to implement DISA stig hardening on to 2 centos 6 virtual machines.
---
- name: Stig implementation
hosts: Database
tasks:
- name: upgrade all packages
command: yum upgrade -y
- name: update all packages
command: yum update -y
- name: /etc/passd file is owned by root
command: chown root:root /etc/passwd
- name: remove rsh-server package
command: yum erase rsh-server
- name: bootload configuration owner is root
command: chgrp root /etc/grub.conf
- name: rshd service disabled
command: chkconfig rsh off
- name: rexecd service disabled
command: chkconfig rexec off
- name: remove telnet and telnet-server
command: yum erase telnet-server && yum erase telnet
- lineinfile: dest=/etc/ssh/sshd_config
state=present
regexp='PermitEmptyPasswords'
line='PermitEmptyPasswords no'
backup=yes
- lineinfile: dest=/etc/ssh/sshd_config
state=present
regexp='HostbasedAuthentication'
line='HostbasedAuthentication no'
backup=yes
- name: Change etc/group ownership
command: chgrp root /etc/group
- name: operating system must connect to external networks
command: chkconfig ip6tables on && service ip6tables start
- name: add lines
lineinfile: dest=/etc/audit/audit.rules
line='{{item}}'
with_items:
- '-w /sbin/insmod -p x -k modules'
- '-w /sbin/rmmod -p x -k modules'
- '-w /sbin/modprobe -p x -k modules'
- '-a always,exit -F arch=[b64] -S init_module -S delete_module -k modules'
- name: disable xinetd
command: chkconfig xinetd off && service xinetd stop
- name: turn off and disable netconsole
command: chkconfig netconsole off && service netconsole stop
A copy of my host file
[localhost]
x.x.x.x
[Database]
x.x.x.x
x.x.x.x
I suppose this is a playbook... could you try removing the second line:
---
- hosts: Database
tasks:
...
I need to run playbooks on Vagrant boxes and on aws when I setup environment with cloud formation.
In Vagrant file I use ansible-local and everything works fine
name: Setup Unified Catalog Webserver
hosts: 127.0.0.1
connection: local
become: yes
become_user: root
roles: generic
However when I create instance in AWS the ansible playbook fails with error:
sudo: sorry, you must have a tty to run sudo
This happen because it is run as root and it doesnt have tty. But I dont know how to fix it without making change in /etc/sudoers to allow !requiretty
Is there any flags I can setup in ansible.cfg or in my Cloud Formation template?
"#!/bin/bash\n", "\n", "
echo 'Installing Git'\n","
yum --nogpgcheck -y install git ansible htop nano wget\n",
"wget https://s3.eu-central-1.amazonaws.com/XXX -O /root/.ssh/id_rsa\n",
"chmod 600 /root/.ssh/id_rsa\n",
"ssh-keyscan 172.31.7.235 >> /root/.ssh/known_hosts\n",
"git clone git#172.31.7.235:something/repo.git /root/repo\n",
"ansible-playbook /root/env/ansible/test.yml\n
I was able to fix this by setting the transport = paramiko configuration in ansible.cfg.
I have found the following solutions for myself:
1. Change requiretty in /etc/sudoers with sed run playbooks and change it back.
"#!/bin/bash\n", "\n", "
echo 'Installing Git'\n","
yum --nogpgcheck -y install git ansible htop nano wget\n",
"wget https://s3.eu-central-1.amazonaws.com/xx/ansible -O /root/.ssh/id_rsa\n",
"chmod 600 /root/.ssh/id_rsa\n",
"ssh-keyscan 172.31.9.231 >> /root/.ssh/known_hosts\n",
"git clone git#172.31.5.254:somerepo/dev.git /root/dev\n",
"sed -i 's/Defaults requiretty/Defaults !requiretty/g' /etc/sudoers\n",
"\n",
"ansible-playbook /root/dev/env/ansible/uk.yml\n",
"\n",
"sed -i 's/Defaults !requiretty/Defaults requiretty/g' /etc/sudoers\n"
OR
2. In ansible playbook specify variable:
- name: Setup
hosts: 127.0.0.1
connection: local
sudo: {{ require_sudo }}
roles:
- generic
Run in AWS Cloud Formation template would be
"ansible-playbook -e require_sudo=False /root/dev/env/ansible/uk.yml\n"
And for Vagrant in ansible.cfg it can be specified
require_sudo=True
Also in CF template may identify who is running and the pass variable
ansible-playbook -e$(id -u |egrep '^0$' > /dev/null && require_sudo=False || require_sudo=True; echo "require_sudo=$require_sudo") /apps/ansible/uk.yml
If you need to specific connection: paramiko within just one playbook versus a global configuration in ansible.cfg, you can add connection: paramiko following in the playbook, example:
- name: Run checks after deployments
hosts: all
# https://github.com/paramiko/paramiko/issues/1369
connection: paramiko
gather_facts: True
I am trying to wget a file from a web server from within an Ansible playbook.
Here is the Ansible snippet:
---
- hosts: all
sudo: true
tasks:
- name: Prepare Install folder
sudo: true
action: shell sudo mkdir -p /tmp/my_install/mysql/ && cd /tmp/my_install/mysql/
- name: Download MySql
sudo: true
action: shell sudo wget http://{{ repo_host }}/MySQL-5.6.15-1.el6.x86_64.rpm-bundle.tar
Invoking it via:
ansible-playbook my_3rparties.yml -l vsrv644 --extra-vars "repo_host=vsrv656" -K -f 10
It fails with the following:
Cannot write to `MySQL-5.6.15-1.el6.x86_64.rpm-bundle.tar' (Permission denied).
FATAL: all hosts have already failed -- aborting
PLAY RECAP ********************************************************************
to retry, use: --limit #/usr2/ihazan/vufroria_3rparties.retry
vsrv644 : ok=2 changed=1 unreachable=0 failed=1
When trying to do the command that fail via regular remote ssh to mimic what ansible would do, it doesn't work as follows:
-bash-4.1$ ssh ihazan#vsrv644 'cd /tmp/my_install/mysql && sudo wget http://vsrv656/MySQL-5.6.15-1.el6.x86_64.rpm-bundle.tar'
Enter passphrase for key '/usr2/ihazan/.ssh/id_rsa':
sudo: sorry, you must have a tty to run sudo
But I can solve it using -t as follows:
-bash-4.1$ ssh -t ihazan#vsrv644 'cd /tmp/my_install/mysql && sudo wget http://vsrv656/MySQL-5.6.15-1.el6.x86_64.rpm-bundle.tar'
Then it works.
Is there a way to set the -t (pseudo tty option) on ansible?
P.S: I could solve it by editing the sudoers file as others propose but that is a manual step I am trying to avoid.
Don't use shell-module when there is specialized modules available. In your case:
Create directories with file-module:
- name: create project directory {{ common.project_dir }}
file: state=directory path={{ common.project_dir }}
Download files with get_url-module:
- name: download sources
get_url: url={{ opencv.url }} dest={{ common.project_dir }}/{{ opencv.file }}
Note the new module call syntax in the examples above.
If you have to use sudo with password remember to give --ask-sudo-pass when needed (see e.g. Remote Connection Information).
In Ansible:
file to manage files/directories
get_url to download what you need
become:yes to use sudo priviledges
See ansible documentation:
https://docs.ansible.com/ansible/latest/modules/modules_by_category.html