# Another sudo issue

**URL:** <https://forum.ansible.com/t/another-sudo-issue/15468>\
**Category:** Ansible Project\
**Created:** [June 15, 2014, 11:15pm UTC](https://forum.ansible.com/t/another-sudo-issue/15468 "2014-06-15T23:15:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cameron\_Junge](https://avatars.discourse-cdn.com/v4/letter/c/0ea827/32.png) [@Cameron\_Junge](https://forum.ansible.com/u/Cameron_Junge)\
**Post date:** [June 15, 2014, 11:15pm UTC](https://forum.ansible.com/t/another-sudo-issue/15468/1 "2014-06-15T23:15:51Z")

</div>

Hi All,

Just getting started with Ansible and I’m having issues with some of the sudo stuff.

I have a user deployer, who has limited permissions on the server. Neither deployer nor root have a password set, I’m using ssh keys for deployer.

I am trying to give deployer permission to stop/start services on the server, and have tried to give them access in sudoers:

`  
deployer ALL=(root) NOPASSWD: /usr/sbin/service

`

In my playbook I have a task:

`  
tasks:

- name: Stop Nginx  
sudo: yes  
service:  
name: nginx  
state: stopped

`

From what I can see, the “sudo: yes” causes the script to be wrapped in an Ansible sudo call, which uses /bin/sh to run the generated script. As the user doesn’t have permission to run /bin/sh as root the result is the play locking up waiting for a password to be entered.

`  
 ESTABLISH CONNECTION FOR USER: deployer  
 REMOTE\_MODULE service name=nginx state=stopped  
 EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘User=deployer’, ‘-o’, ‘ConnectTimeout=10’, ‘server’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && echo $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072’”]  
 PUT /tmp/tmpzh6oFh TO /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service  
 EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘User=deployer’, ‘-o’, ‘ConnectTimeout=10’, ‘server’, u’/bin/sh -c 'sudo -k && sudo -H -S -p “[sudo via ansible, key=xqpamkcjagkzzsxuwdwnijqkrpitvqyy] password: " -u root /bin/sh -c '”'“'echo SUDO-SUCCESS-xqpamkcjagkzzsxuwdwnijqkrpitvqyy; LC\_CTYPE=C LANG=C /usr/bin/python /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service'”'"''']

`

I could set the user to have permission to run /bin/sh, but that seems incorrect (may as well set it to ALL, which btw does work as I desire).

Is this something that I can resolve either in sudoers, or in the Ansible script?

Any help would be appreciated.

Cheers, Cameron

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [June 16, 2014, 1:28am UTC](https://forum.ansible.com/t/another-sudo-issue/15468/2 "2014-06-16T01:28:23Z")

</div>

Do I infer correctly that you have your sudo environment locked down so users can only run specific commands? If so, that won’t be compatible.

---

<div class="post-metadata">

**Author:** ![Cameron\_Junge](https://avatars.discourse-cdn.com/v4/letter/c/0ea827/32.png) [@Cameron\_Junge](https://forum.ansible.com/u/Cameron_Junge)\
**Post date:** [June 17, 2014, 11:59pm UTC](https://forum.ansible.com/t/another-sudo-issue/15468/3 "2014-06-17T23:59:12Z")

</div>

Yes that’s correct, or at least that was the intention.

I was hoping to be able to restrict sudo to just be able to run eg. sudo service nginx restart, but by using /bin/sh to wrap the call it breaks that intention.

So I take it that there is no way to use ansible to call a command via sudo without ansible using /bin/sh? (ignoring that I could use shell: sudo service nginx restart).

if there is no way of doing this, maybe the docs should be updated to reflect this?

Cheers, Cameron

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [June 18, 2014, 3:48pm UTC](https://forum.ansible.com/t/another-sudo-issue/15468/4 "2014-06-18T15:48:28Z")

</div>

Ansible can pick an executable but you can not arbitrary confine sudo since it runs lots of ansible modules not simple shell commands.

I believe the docs already discuss it to the proper depth.