Run ansible as root with specific sudoers

315 Views Asked by At

My issue is that I have one server where the sudoers for the ansible user is like this:

ansible ALL=(root) NOPASSWD: /usr/bin/su - root

Hence, the only way to switch to the root user is:

sudo su - root


When I try to run the below ansible playbook:

---
- name: Configure Local Repo server address
  hosts: lab
  remote_user: ansible
  become: yes
  become_user: root
  become_method: runas
    
  tasks:
    - name: test whoami
      become: yes
      shell:
        cmd: whoami
      register: whoami_output
    - debug: var=whoami_output
    
    - name: Deploy local.repo file to the hosts
      become: yes
      copy:
        src: /etc/ansible/files/local.repo
        dest: /etc/yum.repos.d/local.repo
        owner: ansible
        group: ansible
        mode: 0644
        backup: yes
      register: deploy_file_output
    - debug: var=deploy_file_output

I got the following error:

ansible-playbook --private-key /etc/ansible/keys/ansible_key /etc/ansible/playbooks/local_repo_provisioning.yml

PLAY [Configure Local Repo server address] *****************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************************************************************************************************************************************
ok: [10.175.65.12]

TASK [test whoami] *****************************************************************************************************************************************************************************************************************************
changed: [10.175.65.12]

TASK [debug] ***********************************************************************************************************************************************************************************************************************************
ok: [10.175.65.12] => {
    "whoami_output": {
        "changed": true,
        "cmd": "whoami",
        "delta": "0:00:00.003301",
        "end": "2023-01-15 17:53:56.312715",
        "failed": false,
        "msg": "",
        "rc": 0,
        "start": "2023-01-15 17:53:56.309414",
        "stderr": "",
        "stderr_lines": [],
        "stdout": "ansible",
        "stdout_lines": [
            "ansible"
        ]
    }
}

TASK [Deploy local.repo file to the hosts] *****************************************************************************************************************************************************************************************************
fatal: [10.175.65.12]: FAILED! => {"changed": false, "checksum": "2356deb90d20d5f31351c719614d5b5760ab967d", "msg": "Destination /etc/yum.repos.d not writable"}

PLAY RECAP *************************************************************************************************************************************************************************************************************************************
10.175.65.12               : ok=3    changed=1    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

When I tried to use become_method: sudo I got the "Missing sudo password" message. Further, when I tried become_method: su I got the "Timeout (12s) waiting for privilege escalation prompt:" message.


All in all, would someone know how to explain how ansible runs the commands deppending on the "become_method" set? Is there a way to switch to the root user with that kind of sudoers conf?

Thanks in advance!

0

There are 0 best solutions below