# agent forwarding with sudo **URL:** \ **Category:** Ansible Project\ **Created:** [May 31, 2013, 4:22pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889 "2013-05-31T16:22:55Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Lorin\_Hochstein1](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Lorin\_Hochstein1](https://forum.ansible.com/u/Lorin_Hochstein1)\ **Post date:** [May 31, 2013, 4:22pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/1 "2013-05-31T16:22:55Z")
I ran into a situation today where I needed to support agent forwarding with sudo. Specifically, I wanted to check out a git repository using agent forwarding, sudo’ing to a (non-root) user. I started working on a patch to add support for this in ansible \<[https://github.com/lorin/ansible/tree/sudo-agent-forward](https://github.com/lorin/ansible/tree/sudo-agent-forward)\>. It’s functional, although not quite ready for submission. Michael, are you interested in this type of functionality? Lorin ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [May 31, 2013, 4:35pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/2 "2013-05-31T16:35:04Z")
Sure thing, send in a pull request when you get ready. –Michael ---
**Author:** ![Rodney\_Quillo](https://avatars.discourse-cdn.com/v4/letter/r/7ba0ec/32.png) [@Rodney\_Quillo](https://forum.ansible.com/u/Rodney_Quillo)\ **Post date:** [June 1, 2013, 3:20am UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/3 "2013-06-01T03:20:29Z")
+1 I'm using this workaround for ssh-agent forwarding: /etc/sudoers file by adding: Defaults env\_keep+=SSH\_AUTH\_SOCK ---
**Author:** ![Rodney\_Quillo](https://avatars.discourse-cdn.com/v4/letter/r/7ba0ec/32.png) [@Rodney\_Quillo](https://forum.ansible.com/u/Rodney_Quillo)\ **Post date:** [June 1, 2013, 3:24am UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/4 "2013-06-01T03:24:22Z")
note this one works for root only. ---
**Author:** ![Lorin\_Hochstein1](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Lorin\_Hochstein1](https://forum.ansible.com/u/Lorin_Hochstein1)\ **Post date:** [June 2, 2013, 1:32am UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/5 "2013-06-02T01:32:49Z")
Rodney: My plan for the sudo support is to use the “env” program to inject the SSH\_AUTH\_SOCK environment variable into the sudo’d process, so that editing /etc/sudoers isn’t necessary. For sudo’ing to non-root users, I’m going to use access control lists to grant the sudo\_user access to the auth socket, like this: setfacl -m u:sudo\_user:rw $SSH\_AUTH\_SOCK setfacl -m u:sudo\_user:x $(dirname $SSH\_AUTH\_SOCK) Lorin ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [June 2, 2013, 12:21pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/6 "2013-06-02T12:21:23Z")
Just thinking out loud here, not all filesystems we log in to may support ACLs, it will need to plan accordingly if so configured, or at least raise errors. ---
**Author:** ![Lorin\_Hochstein1](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Lorin\_Hochstein1](https://forum.ansible.com/u/Lorin_Hochstein1)\ **Post date:** [June 3, 2013, 1:07pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/7 "2013-06-03T13:07:02Z")
Good point. I will probably make the ACL-based approach opt-in by an additional configuration option. Without ACLs, it probably will only support agent-forwarding when sudo’ing to root. Lorin ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [September 13, 2013, 10:55am UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/8 "2013-09-13T10:55:34Z")
For you info I worked on a pull request that adds agent forwarding to the paramiko transport : [https://groups.google.com/forum/#!topic/ansible-project/-wD8nVlFWQQ](https://groups.google.com/forum/#!topic/ansible-project/-wD8nVlFWQQ) the 2 subjects are related (and I used some of your code for the sudo/sudo\_user part !) ---
**Author:** ![user102](https://avatars.discourse-cdn.com/v4/letter/u/57b2e6/32.png) [@user102](https://forum.ansible.com/u/user102)\ **Post date:** [November 21, 2013, 9:19am UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/9 "2013-11-21T09:19:15Z")
I ran into the same problem. Isn’t your solution in the upstream? ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [November 21, 2013, 9:09pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/10 "2013-11-21T21:09:50Z")
This functionality has not been merged into ansible. You can checkout a comment I left on a ticket where I explained how to get this working: [https://github.com/ansible/ansible/issues/4378#issuecomment-25758372](https://github.com/ansible/ansible/issues/4378#issuecomment-25758372) ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [November 21, 2013, 9:34pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/11 "2013-11-21T21:34:19Z")
no it has not been accepted upstream. you can still find the proposed PR here - [https://github.com/jeromew/ansible/commit/7b14e45bf7432edf64decd26db7494f9b4c3e0ec](https://github.com/jeromew/ansible/commit/7b14e45bf7432edf64decd26db7494f9b4c3e0ec) the patch works but the solution need some hacks that cannot be accepted by everyone ; so Michael preferred to not accept it knowing that paramiko support is doomed on the long term. I agree with his decision even though I had to change my deploy approach. for a detailed overview of the forwarding problematic: [https://github.com/ansible/ansible/pull/4100](https://github.com/ansible/ansible/pull/4100) you have in fact 3 patches in the link above : 1 - support agent forwarding for paramiko (so the ansible\_ssh\_user can use the keys) 2- export the SSH\_AUTH\_SOCK when sudo’ing without requiring a modification of sudoers (sudo\_user = root can use the keys) 3- change the ACLs on SSH\_AUTH\_SOCK (sudo\_user != root can use the keys) (1) is not necessary if your control machine does not need paramiko (2) is not necessary if you accept to modify sudoers (3) is the only way I found to give access to the keys to sudo\_user != root other ways around that people have mentioned for (3) : a) do (1) and authorize the control machine to ssh directly login = user b) create temporary read-only keys on the git repo that you dispatch to the users c) do (1), git with ansible\_ssh\_user and then move the files to another user d) pre-package all apps on the control machine and do not invoke github on the remotes I would be interested in hearing how github dependent people are handling their deployments. Jerome ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [November 21, 2013, 11:50pm UTC](https://forum.ansible.com/t/agent-forwarding-with-sudo/12889/12 "2013-11-21T23:50:48Z")
> I would be interested in hearing how github dependent people are handling > their deployments. I'd like to see the git module enhanced to take an optional username/password, or a deploy key, and also be smart enough to add github.com to known hosts if a special flag is added, I think that would reduce most confusion with git, especially SSH. We've got a feature idea ticket open, but are probably chasing a few other things first. If someone wants to upgrade it, I will build a statue of you in our formal gardens in your choice of rock or affordable metals (sorry Platinum is probably not a good option) (once we have a formal gardens, of course).