# ansible and sudo

**URL:** <https://forum.ansible.com/t/ansible-and-sudo/12140>\
**Category:** Ansible Project\
**Tags:** ansible-project\
**Created:** [December 16, 2012, 7:09pm UTC](https://forum.ansible.com/t/ansible-and-sudo/12140 "2012-12-16T19:09:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [December 16, 2012, 7:09pm UTC](https://forum.ansible.com/t/ansible-and-sudo/12140/1 "2012-12-16T19:09:44Z")

</div>

You'll be able to use the raw module and not much else.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\
**Post date:** [December 16, 2012, 7:23pm UTC](https://forum.ansible.com/t/ansible-and-sudo/12140/2 "2012-12-16T19:23:13Z")

</div>

ansible istanbul -m raw -a “/app/jboss/int/apache-2.2.23-p2/tools/ITPapache2 stop” --sudo --ask-sudo-pass

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [December 19, 2012, 1:34am UTC](https://forum.ansible.com/t/ansible-and-sudo/12140/3 "2012-12-19T01:34:28Z")

</div>

Ok, so here's the deal.

Ansible has lots of design goals. Limited sudo is far off the  
beaten path from some of the other design goals.

zero bootstrapping is one, so it installs modules in temp dirs. You  
do not have to install 'ansible-helpers' or any package prior to using  
ansible from a remote machine. Bare cloud images are cool.

Having a well defined resource model is one, so it doesn't just  
execute unix commands, it runs programs (modules are programs). For  
various reasons of using SSH as transport, the arguments to these  
"programs" are baked into the modules themselves, to optimize how we  
do things over SSH (which is not ordinarily, shall we say, super  
zippy).

Being able to execute commands is one, so it allows executing commands  
as whatever user anyway -- as modules don't exist for everything you  
want to run.

The basic answer is no, the user needs to be able to login and do  
actual 'stuff'.

Compare this of course with all the other config management packages  
that run root level agents and ansible can be constrained a lot better  
-- because you can actually use that resource model as not root, do  
non-root things (obviously some modules won't work then), or if you  
want root, access them via other accounts.

So, yeah, you are not going to make a sudo policy that allows user  
'xyz' to create users, because ansible is not a series of modules  
calling bash commands with 'sudo'. Modules are programs.

For all of these various reasons, especially the no bootstrapping one,  
the answer is no.

You can things as non-root, or root, or sudo to root ... but you can't  
really limit sudo to specific commands.

I'm ok with that -- the other properties are very worth it.