I am trying to run an extremely simple playbook to test a new Ansible setup.
When using the 'new' Ansible Privilege Escalation config options in my ansible.cfg file:
[defaults]
host_key_checking=false
log_path=./logs/ansible.log
executable=/bin/bash
#callback_plugins=./lib/callback_plugins
######
[privilege_escalation]
become=True
become_method='sudo'
become_user='tstuser01'
become_ask_pass=False
[ssh_connection]
scp_if_ssh=True
I get the following error:
fatal: [webserver1.local] => Internal Error: this module does not support running commands via 'sudo'
FATAL: all hosts have already failed -- aborting
The playbook is also very simple:
# Checks the hosts provisioned by midrange
---
- name: Test su connecting as current user
hosts: all
gather_facts: no
tasks:
- name: "sudo to configued user -- tstuser01"
#action: ping
command: /usr/bin/whoami
I am not sure if there is something broken in Ansible 1.9.1 or if I am doing something wrong. Surely the 'command' module in Ansible allows running commands as sudo.
The issue is with configuration; I also took it as an example and got the same problem. After playing awhile I noticed that the following works:
1) deprecated sudo:
---
- hosts: all
sudo: yes
gather_facts: no
tasks:
- name: "sudo to root"
command: /usr/bin/whoami
2) new become
---
- hosts: all
become: yes
become_method: sudo
gather_facts: no
tasks:
- name: "sudo to root"
command: /usr/bin/whoami
3) using ansible.cfg:
[privilege_escalation]
become = yes
become_method = sudo
and then in a playbook:
---
- hosts: all
gather_facts: no
tasks:
- name: "sudo to root"
command: /usr/bin/whoami
since you "becoming" tstuser01 (not a root like me), please play a bit, probably user name should not be quoted too:
become_user = tstuser01
at least this is the way I define remote_user in ansible.cfg and it works... My issue resolved, hope yours too
I think you should use the sudo directive in the hosts section so that subsequent tasks can run with sudo privileges unless you explicitly specified sudo:no in a task.
Here's your playbook that I've modified to use sudo directive.
# Checks the hosts provisioned by midrange
---
- hosts: all
sudo: yes
gather_facts: no
tasks:
- name: "sudo to configued user -- tstuser01"
command: /usr/bin/whoami
Related
I'd like to make a playbook that shows me the user currently in use.
this is my ansible cfg:
[defaults]
inventory=inventory
remote_user=adminek
[privilege_escalation]
become=true
[ssh_connection]
allow_world_readable_tmpfiles = True
ssh_args = -o ControlMaster=no -o ControlPath=none -o ControlPersist=no
pipelining = false
and this is my playbook
---
- name: show currenty users
hosts: server_a
tasks:
- name: test user - root
shell: "whoami"
register: myvar_root
- name: test user - user2
become: true
become_user: user2
shell: "whoami"
register: myvar_user2
- name: print myvar root
debug:
var: myvar_root.stdout_lines
- name: print myvar user2
debug:
var: myvar_user2.stdout
taks "test user - root" work fine and give me output
ok: [172.22.0.134] => {
"myvar_root.stdout_lines": [
"root"
]
}
taks "test user - user2" give me output
fatal: [172.22.0.134]: FAILED! => {"msg": "Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chown: changing ownership `/var/tmp/ansible-tmp-1621340458.2-11599-141854654478770/': Operation permited\nchown: changing ownership `/var/tmp/ansible-tmp-1621340458.2-11599-141854654478770/AnsiballZ_command.py': Operation permited\n}). For information on working around this, see https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user"}
Explanation:
adminek- sudoer user
User2 - non sudoers users
OS - Scientific Linux release 6.9
Additionaly I hgad similar problem on ubuntu 18.04 but when i installed acl begun works
Someone know what is wrong?
Thanks for help!
One of the following options should fix your issue:
Ensure sudo is installed on the remote host
Ensure acl is installed on the remote host
Uncomment the following lines in /etc/ansible/ansible.cfg:
allow_world_readable_tmpfiles = True
pipelining = True
#F1ko thanks for reply.
I did what you wont and I installed acl on my host, but steal was wrong.
I added to visudo.
Defaults:user2 !requiretty
Defaults:adminek !requiretty
I dont know it's ok and secure but work.
for me it worked installing the acl package in host
- name: Install required packaged
yum:
name: "{{ item }}"
state: present
with_items:
- acl
- python3-pip
in my case I used centos/07, if you use ubuntu, change yum to apt.
I'm wondering if it is possible to overwrite the executable value set in your ansible.cfg file within a playbook. Something like below...
---
- name: 'New Server Setup'
hosts: 'all'
gather_facts: false
pre_tasks:
- name: 'setup : installing python for ansible'
raw: 'test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)'
changed_when: false
- setup: # aka gather_facts
tags: setup
user: root
become: yes
become_method: sudo
executable: '/bin/bash'
roles:
- setup
I've tried everything I can think of and nothing seems to work.
As per ansible,
Starting in version 2.1 this can be overridden by the inventory var ansible_shell_executable.
I am working with ansible and I want to install tomcat to 2 other ubuntu machines (webserver1, webserver2).
I have a this hosts file:
[group1]
10.40.0.168 ansible_ssh_user=user1
[group2]
10.40.0.83 ansible_ssh_user=user2
And I have this playbook:
---
- hosts: all
sudo: yes
tasks:
- name: install apache
apt: name=apache2 update_cache=yes state=latest
No this works fine just for one host when I use this command:
ansible-playbook apache3.yml --ask-sudo-pass
Because I return one password.
But what's the better/easiest way to make it work for multiple users, with multiple passwords?
You can give the ssh and sudo password while defining the webservers itself
[group1]
ansible_host=10.40.0.168 ansible_ssh_user=user1 ansible_ssh_pass=***** ansible_sudo_pass=*****
[group2]
ansible_host=10.40.0.83 ansible_ssh_user=user2 ansible_ssh_pass=***** ansible_sudo_pass=*****
Reference
I've got a problem with running ansible-playbook
See below my playbook
---
- hosts: some_group
remote_user: someuser
become: true
become_method: sudo
tasks:
- name: Copy file to remote nodes
copy: src=/root/ansible/someimage dest=/home/someuser/
- name: Load exported file of nginx image
command: docker load -i /home/someuser/someimage
The command in terminal is:
ansible-playbook test.yml --ask-pass -K
ansible version is 2.0.0.2
The error is : "stderr": "Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock:
Make sure, that you understood the limitations when becoming an unprivileged user. I would try to avoid this.
Instead you can work as privileged user. You just have to fix the permissions.
---
- hosts: some_group
become: true
tasks:
- name: Copy file to remote nodes
copy: src=/root/ansible/someimage dest=/home/someuser/someimage
- name: Set permisions
file:
dest: /home/someuser/someimage
owner: someuser
group: someuser
mode: 0644
- name: Load exported file of nginx image
command: sudo someuser docker load -i /home/someuser/someimage
my loginuser is user1 and i want to execute the playbook with root. how can i do this. if i use in cmdline it does not work like this
ansible-playbook main.yaml -i hosts --user=git -k --become-user=root --ask-become-pass --become-method=su
Please tell me how to implement this.
name: Install and Configure IEM
hosts: rhel
ansible_become: yes
ansible_become_method: su
ansible_become_user: root
ansible_become_pass: passw0rd
tasks:
- name: Creating masthead file path
file: path=/etc/opt/BESClient state=directory
- name: Creating install directory
I use :
deploy.yml
- name: Todo something
hosts: all
become: yes
become_user: root
become_method: su
When you execute the playbook pass the password as an extra var.
--extra-vars='ansible_become_pass=password'
From Ansible docs:
you can set those in the playbook as #Raul-Hugo, with become_user and become_user;
alternatively, it can also be done in the inventory, which allows setting per host or group. But then the variables get "ansible_" prefix: ansible_become_user, ansible_become_user, etc. That's why the playbook you gave in your question did not work: it used variable names that are used in the inventory.
You can become root like below and install the packages
tasks:
- name: install apache package
become: yes
become_user: root
yum:
name: httpd
state: present
- name: ensure apache is running
become: yes
become_user: root
service:
name: httpd
state: started
All the above answers caused Ansible to try to login as root from the beginning. but in this case, the user you request is git so the below example worked for me:
- name: Install and Configure IEM
hosts: rhel
tasks:
- name: Creating masthead file path
file: path=/etc/opt/BESClient state=directory
remote_user: git
become: yes # when not specifying `become_user` it's "root"
This will cause it to login as git and after the login - switch to root