# Ansible 2.3.0.0 privilege escalation doesn't work correct **URL:** \ **Category:** Ansible Project\ **Created:** [April 17, 2017, 4:13pm UTC](https://forum.ansible.com/t/ansible-2-3-0-0-privilege-escalation-doesnt-work-correct/24226 "2017-04-17T16:13:52Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![TheUnicornXXL](https://avatars.discourse-cdn.com/v4/letter/t/ea5d25/32.png) [@TheUnicornXXL](https://forum.ansible.com/u/TheUnicornXXL)\ **Post date:** [April 17, 2017, 4:13pm UTC](https://forum.ansible.com/t/ansible-2-3-0-0-privilege-escalation-doesnt-work-correct/24226/1 "2017-04-17T16:13:52Z")
Hi from ansible 1.9 till 2.2.2.0 on centos 7 privilege escalation works really fine. I could access a server with a non privileged user and a ssh key authentication and use as last step the privilege escalation with su. But with 2.3 I found this doesn't work any more. The ssh connection to the server works, I see the server accepts the public key for user "ansible", but after this ansible tries to do the privilege escalation to user root and hangs. I think it waits for the password. If I start the last code manual, it asks for it as the next step. Other point: Ansible ignores the host configuration for become and become\_method if I don't set them at ansible.cfg. Paramiko doesn't work too. I tried it, same effect. There I have additionally the problem that paramiko has it's own key storage and stops (no input possible to the quest if want to add the key) if the key is not there (I know the option "host\_key\_auto\_add"). I think the handling should be optimized. ansible.cfg (all other options after this are remarked): [privilege\_escalation] become=True #become\_method=sudo become\_method=su #become\_user=root #become\_ask\_pass=False host configuration: ansible\_become: yes ansible\_become\_user: root ansible\_become\_pass: XXXXX ansible\_become\_methode: su ansible\_connection: ssh here the logs: [root@ansible host\_vars]# ansible kronos.cac.local -m ping -vvvvv Using /etc/ansible/ansible.cfg as config file Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callback/\_\_init\_\_.pyc META: ran handlers Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/ping.py \ ESTABLISH SSH CONNECTION FOR USER: ansible \ SSH: ansible.cfg set ssh\_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \ SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no) \ SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ansible) \ SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \ SSH: PlayContext set ssh\_common\_args: () \ SSH: PlayContext set ssh\_extra\_args: () \ SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/root/.ansible/cp/25edd394cf) \ SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/25edd394cf kronos.cac.local '/bin/sh -c '"'"'echo ~ && sleep 0'"'"'' \ (0, '/home/ansible\n', 'OpenSSH\_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 56: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/root/.ansible/cp/25edd394cf" does not exist\r\ndebug2: ssh\_connect: needpriv 0\r\ndebug1: Connecting to kronos.cac.local [192.168.76.22] port 22.\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug1: fd 3 clearing O\_NONBLOCK\r\ndebug1: Connection established.\r\ndebug3: timeout: 10000 ms remain after connect\r\ndebug1: permanently\_set\_uid: 0/0\r\ndebug3: Incorrect RSA1 identifier\r\ndebug3: Could not load "/root/.ssh/id\_rsa" as a RSA1 public key\r\ndebug1: identity file /root/.ssh/id\_rsa type 1\r\ndebug1: identity file /root/.ssh/id\_rsa-cert type -1\r\ndebug1: identity file /root/.ssh/id\_dsa type -1\r\ndebug1: identity file /root/.ssh/id\_dsa-cert type -1\r\ndebug1: identity file /root/.ssh/id\_ecdsa type -1\r\ndebug1: identity file /root/.ssh/id\_ecdsa-cert type -1\r\ndebug1: identity file /root/.ssh/id\_ed25519 type -1\r\ndebug1: identity file /root/.ssh/id\_ed25519-cert type -1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-OpenSSH\_6.6.1\r\ndebug1: Remote protocol version 2.0, remote software version OpenSSH\_6.6.1\r\ndebug1: match: OpenSSH\_6.6.1 pat OpenSSH\_6.6.1\* compat 0x04000000\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug3: load\_hostkeys: loading entries for host "kronos.cac.local" from file "/root/.ssh/known\_hosts"\r\ndebug3: load\_hostkeys: found key type ECDSA in file /root/.ssh/known\_hosts:13\r\ndebug3: load\_hostkeys: loaded 1 keys\r\ndebug3: order\_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521\r\ndebug1: SSH2\_MSG\_KEXINIT sent\r\ndebug1: SSH2\_MSG\_KEXINIT received\r\ndebug2: kex\_parse\_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex\_parse\_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss\r\ndebug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex\_parse\_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex\_parse\_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex\_parse\_kexinit: zlib@openssh.com,zlib,none\r\ndebug2: kex\_parse\_kexinit: zlib@openssh.com,zlib,none\r\ndebug2: kex\_parse\_kexinit: \r\ndebug2: kex\_parse\_kexinit: \r\ndebug2: kex\_parse\_kexinit: first\_kex\_follows 0 \r\ndebug2: kex\_parse\_kexinit: reserved 0 \r\ndebug2: kex\_parse\_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex\_parse\_kexinit: ssh-rsa,ecdsa-sha2-nistp256\r\ndebug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex\_parse\_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex\_parse\_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex\_parse\_kexinit: none,zlib@openssh.com\r\ndebug2: kex\_parse\_kexinit: none,zlib@openssh.com\r\ndebug2: kex\_parse\_kexinit: \r\ndebug2: kex\_parse\_kexinit: \r\ndebug2: kex\_parse\_kexinit: first\_kex\_follows 0 \r\ndebug2: kex\_parse\_kexinit: reserved 0 \r\ndebug2: mac\_setup: setup hmac-md5-etm@openssh.com\r\ndebug1: kex: server-\>client aes128-ctr hmac-md5-etm@openssh.com zlib@openssh.com\r\ndebug2: mac\_setup: setup hmac-md5-etm@openssh.com\r\ndebug1: kex: client-\>server aes128-ctr hmac-md5-etm@openssh.com zlib@openssh.com\r\ndebug1: kex: curve25519-sha256@libssh.org need=16 dh\_need=16\r\ndebug1: kex: curve25519-sha256@libssh.org need=16 dh\_need=16\r\ndebug1: sending SSH2\_MSG\_KEX\_ECDH\_INIT\r\ndebug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY\r\ndebug1: Server host key: ECDSA XX:XX:XX:XX:XX:XX:XX:XX:XX:XX\r\ndebug3: load\_hostkeys: loading entries for host "kronos.cac.local" from file "/root/.ssh/known\_hosts"\r\ndebug3: load\_hostkeys: found key type ECDSA in file /root/.ssh/known\_hosts:13\r\ndebug3: load\_hostkeys: loaded 1 keys\r\ndebug3: load\_hostkeys: loading entries for host "192.168.76.22" from file "/root/.ssh/known\_hosts"\r\ndebug3: load\_hostkeys: found key type ECDSA in file /root/.ssh/known\_hosts:3\r\ndebug3: load\_hostkeys: loaded 1 keys\r\ndebug1: Host \'kronos.cac.local\' is known and matches the ECDSA host key.\r\ndebug1: Found key in /root/.ssh/known\_hosts:13\r\ndebug1: ssh\_ecdsa\_verify: signature correct\r\ndebug2: kex\_derive\_keys\r\ndebug2: set\_newkeys: mode 1\r\ndebug1: SSH2\_MSG\_NEWKEYS sent\r\ndebug1: expecting SSH2\_MSG\_NEWKEYS\r\ndebug2: set\_newkeys: mode 0\r\ndebug1: SSH2\_MSG\_NEWKEYS received\r\ndebug1: SSH2\_MSG\_SERVICE\_REQUEST sent\r\ndebug2: service\_accept: ssh-userauth\r\ndebug1: SSH2\_MSG\_SERVICE\_ACCEPT received\r\ndebug2: key: /root/.ssh/id\_rsa (0x7f6c8c9e4f30),\r\ndebug2: key: /root/.ssh/id\_dsa ((nil)),\r\ndebug2: key: /root/.ssh/id\_ecdsa ((nil)),\r\ndebug2: key: /root/.ssh/id\_ed25519 ((nil)),\r\ndebug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password\r\ndebug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password\r\ndebug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod\_lookup gssapi-with-mic\r\ndebug3: remaining preferred: gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod\_is\_enabled gssapi-with-mic\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Unspecified GSS failure. Minor code may provide more information\nNo Kerberos credentials available (default cache: KEYRING:persistent:0)\n\r\ndebug1: Unspecified GSS failure. Minor code may provide more information\nNo Kerberos credentials available (default cache: KEYRING:persistent:0)\n\r\ndebug2: we did not send a packet, disable method\r\ndebug3: authmethod\_lookup gssapi-keyex\r\ndebug3: remaining preferred: hostbased,publickey\r\ndebug3: authmethod\_is\_enabled gssapi-keyex\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: No valid Key exchange context\r\ndebug2: we did not send a packet, disable method\r\ndebug3: authmethod\_lookup publickey\r\ndebug3: remaining preferred: ,publickey\r\ndebug3: authmethod\_is\_enabled publickey\r\ndebug1: Next authentication method: publickey\r\ndebug1: Offering RSA public key: /root/.ssh/id\_rsa\r\ndebug3: send\_pubkey\_test\r\ndebug2: we sent a publickey packet, wait for reply\r\ndebug1: Server accepts key: pkalg ssh-rsa blen 279\r\ndebug2: input\_userauth\_pk\_ok: fp be:f1:a1:1c:0f:fb:3a:ff:f2:7a:80:8e:d9:94:7c:a0\r\ndebug3: sign\_and\_send\_pubkey: RSA XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX\r\ndebug1: key\_parse\_private2: missing begin marker\r\ndebug1: read PEM private key done: type RSA\r\ndebug1: Enabling compression at level 6.\r\ndebug1: Authentication succeeded (publickey).\r\nAuthenticated to kronos.cac.local ([192.168.76.22]:22).\r\ndebug1: setting up multiplex master socket\r\ndebug3: muxserver\_listen: temporary control path /root/.ansible/cp/25edd394cf.zeNNJ0Eut3wdd1A6\r\ndebug2: fd 4 setting O\_NONBLOCK\r\ndebug3: fd 4 is O\_NONBLOCK\r\ndebug3: fd 4 is O\_NONBLOCK\r\ndebug1: channel 0: new [/root/.ansible/cp/25edd394cf]\r\ndebug3: muxserver\_listen: mux listener channel 0 fd 4\r\ndebug2: fd 3 setting TCP\_NODELAY\r\ndebug3: packet\_set\_tos: set IP\_TOS 0x08\r\ndebug1: control\_persist\_detach: backgrounding master process\r\ndebug2: control\_persist\_detach: background process is 20385\r\ndebug2: fd 4 setting O\_NONBLOCK\r\ndebug1: forking to background\r\ndebug1: Entering interactive session.\r\ndebug2: set\_control\_persist\_exit\_time: schedule exit in 60 seconds\r\ndebug1: multiplexing control connection\r\ndebug2: fd 5 setting O\_NONBLOCK\r\ndebug3: fd 5 is O\_NONBLOCK\r\ndebug1: channel 1: new [mux-control]\r\ndebug3: channel\_post\_mux\_listener: new mux channel 1 fd 5\r\ndebug3: mux\_master\_read\_cb: channel 1: hello sent\r\ndebug2: set\_control\_persist\_exit\_time: cancel scheduled exit\r\ndebug3: mux\_master\_read\_cb: channel 1 packet type 0x00000001 len 4\r\ndebug2: process\_mux\_master\_hello: channel 1 slave version 4\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_master\_read\_cb: channel 1 packet type 0x10000004 len 4\r\ndebug2: process\_mux\_alive\_check: channel 1: alive check\r\ndebug3: mux\_client\_request\_alive: done pid = 20387\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug3: mux\_master\_read\_cb: channel 1 packet type 0x10000002 len 91\r\ndebug2: process\_mux\_new\_session: channel 1: request tty 0, X 0, agent 0, subsys 0, term "xterm", cmd "/bin/sh -c \'echo ~ && sleep 0\'", env 1\r\ndebug3: process\_mux\_new\_session: got fds stdin 6, stdout 7, stderr 8\r\ndebug2: fd 7 setting O\_NONBLOCK\r\ndebug2: fd 8 setting O\_NONBLOCK\r\ndebug1: channel 2: new [client-session]\r\ndebug2: process\_mux\_new\_session: channel\_new: 2 linked to control channel 1\r\ndebug2: channel 2: send open\r\ndebug2: callback start\r\ndebug2: client\_session2\_setup: id 2\r\ndebug1: Sending environment.\r\ndebug1: Sending env LANG = de\_DE.UTF-8\r\ndebug2: channel 2: request env confirm 0\r\ndebug1: Sending command: /bin/sh -c \'echo ~ && sleep 0\'\r\ndebug2: channel 2: request exec confirm 1\r\ndebug3: mux\_session\_confirm: sending success reply\r\ndebug2: callback done\r\ndebug2: channel 2: open confirm rwindow 0 rmax 32768\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug2: channel 2: rcvd adjust 2097152\r\ndebug2: channel\_input\_status\_confirm: type 99 id 2\r\ndebug2: exec request accepted on channel 2\r\ndebug1: client\_input\_channel\_req: channel 2 rtype exit-status reply 0\r\ndebug3: mux\_exit\_message: channel 2: exit message, exitval 0\r\ndebug1: client\_input\_channel\_req: channel 2 rtype eow@openssh.com reply 0\r\ndebug2: channel 2: rcvd eow\r\ndebug2: channel 2: close\_read\r\ndebug2: channel 2: input open -\> closed\r\ndebug2: channel 2: rcvd eof\r\ndebug2: channel 2: output open -\> drain\r\ndebug2: channel 2: obuf empty\r\ndebug2: channel 2: close\_write\r\ndebug2: channel 2: output drain -\> closed\r\ndebug2: channel 2: rcvd close\r\ndebug3: channel 2: will not send data after close\r\ndebug2: channel 2: send close\r\ndebug2: channel 2: is dead\r\ndebug2: channel 2: gc: notify user\r\ndebug3: mux\_master\_session\_cleanup\_cb: entering for channel 2\r\ndebug2: channel 1: rcvd close\r\ndebug2: channel 1: output open -\> drain\r\ndebug2: channel 1: close\_read\r\ndebug2: channel 1: input open -\> closed\r\ndebug2: channel 2: gc: user detached\r\ndebug2: channel 2: is dead\r\ndebug2: channel 2: garbage collecting\r\ndebug1: channel 2: free: client-session, nchannels 3\r\ndebug3: channel 2: status: The following connections are open:\r\n #2 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)\r\n\r\ndebug2: channel 1: obuf empty\r\ndebug2: channel 1: close\_write\r\ndebug2: channel 1: output drain -\> closed\r\ndebug2: channel 1: is dead (local)\r\ndebug2: channel 1: gc: notify user\r\ndebug3: mux\_master\_control\_cleanup\_cb: entering for channel 1\r\ndebug2: channel 1: gc: user detached\r\ndebug2: channel 1: is dead (local)\r\ndebug2: channel 1: garbage collecting\r\ndebug1: channel 1: free: mux-control, nchannels 2\r\ndebug3: channel 1: status: The following connections are open:\r\n\r\ndebug2: set\_control\_persist\_exit\_time: schedule exit in 60 seconds\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n') \ ESTABLISH SSH CONNECTION FOR USER: ansible \ SSH: ansible.cfg set ssh\_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \ SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no) \ SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ansible) \ SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \ SSH: PlayContext set ssh\_common\_args: () \ SSH: PlayContext set ssh\_extra\_args: () \ SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/root/.ansible/cp/25edd394cf) \ SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/25edd394cf kronos.cac.local '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983 `" && echo ansible-tmp-1492441677.22-196285430121983="` echo /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983 `" ) && sleep 0'"'"'' \ (0, 'ansible-tmp-1492441677.22-196285430121983=/home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983\n', 'OpenSSH\_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 56: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_client\_request\_alive: done pid = 20387\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n') \ PUT /tmp/tmpuQPp6j TO /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/ping.py \ SSH: ansible.cfg set ssh\_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \ SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no) \ SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ansible) \ SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \ SSH: PlayContext set ssh\_common\_args: () \ SSH: PlayContext set sftp\_extra\_args: () \ SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/root/.ansible/cp/25edd394cf) \ SSH: EXEC sftp -b - -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/25edd394cf '[kronos.cac.local]' \ (0, 'sftp\> put /tmp/tmpuQPp6j /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/ping.py\n', 'OpenSSH\_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 56: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_client\_request\_alive: done pid = 20387\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug2: Remote version: 3\r\ndebug2: Server supports extension "posix-rename@openssh.com" revision 1\r\ndebug2: Server supports extension "statvfs@openssh.com" revision 2\r\ndebug2: Server supports extension "fstatvfs@openssh.com" revision 2\r\ndebug2: Server supports extension "hardlink@openssh.com" revision 1\r\ndebug2: Server supports extension "fsync@openssh.com" revision 1\r\ndebug3: Sent message fd 6 T:16 I:1\r\ndebug3: SSH\_FXP\_REALPATH . -\> /home/ansible size 0\r\ndebug3: Looking up /tmp/tmpuQPp6j\r\ndebug3: Sent message fd 6 T:17 I:2\r\ndebug3: Received stat reply T:101 I:2\r\ndebug1: Couldn\'t stat remote file: No such file or directory\r\ndebug3: Sent message SSH2\_FXP\_OPEN I:3 P:/home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/ping.py\r\ndebug3: Sent message SSH2\_FXP\_WRITE I:4 O:0 S:32768\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: In write loop, ack for 4 32768 bytes at 0\r\ndebug3: Sent message SSH2\_FXP\_WRITE I:5 O:32768 S:23147\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: In write loop, ack for 5 23147 bytes at 32768\r\ndebug3: Sent message SSH2\_FXP\_CLOSE I:4\r\ndebug3: SSH2\_FXP\_STATUS 0\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n') \ ESTABLISH SSH CONNECTION FOR USER: ansible \ SSH: ansible.cfg set ssh\_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \ SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no) \ SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ansible) \ SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \ SSH: PlayContext set ssh\_common\_args: () \ SSH: PlayContext set ssh\_extra\_args: () \ SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/root/.ansible/cp/25edd394cf) \ SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/25edd394cf kronos.cac.local '/bin/sh -c '"'"'chmod u+x /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/ /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/ping.py && sleep 0'"'"'' \ (0, '', 'OpenSSH\_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 56: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O\_NONBLOCK\r\ndebug2: mux\_client\_hello\_exchange: master version 4\r\ndebug3: mux\_client\_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux\_client\_request\_session: entering\r\ndebug3: mux\_client\_request\_alive: entering\r\ndebug3: mux\_client\_request\_alive: done pid = 20387\r\ndebug3: mux\_client\_request\_session: session request sent\r\ndebug1: mux\_client\_request\_session: master session id: 2\r\ndebug3: mux\_client\_read\_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 0\r\n') \ ESTABLISH SSH CONNECTION FOR USER: ansible \ SSH: ansible.cfg set ssh\_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \ SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no) \ SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ansible) \ SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \ SSH: PlayContext set ssh\_common\_args: () \ SSH: PlayContext set ssh\_extra\_args: () \ SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/root/.ansible/cp/25edd394cf) \ SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/25edd394cf -tt kronos.cac.local '/bin/sh -c '"'"'su -s /bin/sh root -c '"'"'"'"'"'"'"'"'/bin/sh -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-anvbpadyrpgikywkipnzmenksbuoyblm; /usr/bin/python /home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/ping.py; rm -rf "/home/ansible/.ansible/tmp/ansible-tmp-1492441677.22-196285430121983/" > /dev/null 2\>&1'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"''"'"'"'"'"'"'"'"' && sleep 0'"'"'' kronos.cac.local | FAILED! =\> {     "failed": true,     "msg": "Timeout (12s) waiting for privilege escalation prompt: " } Regards Stefan ---
**Author:** ![TheUnicornXXL](https://avatars.discourse-cdn.com/v4/letter/t/ea5d25/32.png) [@TheUnicornXXL](https://forum.ansible.com/u/TheUnicornXXL)\ **Post date:** [April 19, 2017, 8:29pm UTC](https://forum.ansible.com/t/ansible-2-3-0-0-privilege-escalation-doesnt-work-correct/24226/2 "2017-04-19T20:29:44Z")
Hi, did anybody read my message? Regards Stefan ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [April 19, 2017, 8:57pm UTC](https://forum.ansible.com/t/ansible-2-3-0-0-privilege-escalation-doesnt-work-correct/24226/3 "2017-04-19T20:57:19Z")
This was recently resolved in [https://github.com/ansible/ansible/pull/23710](https://github.com/ansible/ansible/pull/23710) and will be included in an eventual 2.3.1 release. ---
**Author:** ![TheUnicornXXL](https://avatars.discourse-cdn.com/v4/letter/t/ea5d25/32.png) [@TheUnicornXXL](https://forum.ansible.com/u/TheUnicornXXL)\ **Post date:** [April 20, 2017, 11:24am UTC](https://forum.ansible.com/t/ansible-2-3-0-0-privilege-escalation-doesnt-work-correct/24226/4 "2017-04-20T11:24:40Z")
Hi Matt, thanks for this information. Version 2.3.0.0 isn't usable for me without this function. Other point I mentioned is Ansible ignores the host configuration for become and become\_method if I don't set them at ansible.cfg. What about this? I thought a host variable overwrites default configuration variables? Should "ansible\_become" and "ansible\_become\_methode" defined at host level overwrite "become" and "become\_methode" defined at ansible.cfg? Regards Stefan