# Ansible become option with passwordless **URL:** \ **Category:** Ansible Project\ **Created:** [March 21, 2016, 7:06am UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940 "2016-03-21T07:06:05Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![selvam\_vasu](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@selvam\_vasu](https://forum.ansible.com/u/selvam_vasu)\ **Post date:** [March 21, 2016, 7:06am UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/1 "2016-03-21T07:06:05Z")
Hi, I am newbie to ansible. You can find it easily through this dump question. I have limited access to one user(selvam) which can ran limited commands using sudo option. My sudoers file looks like below. selvam ALL=(ALL) NOPASSWD: /usr/sbin/service,/usr/bin/apt-get I have tried to install apt package in remote machine using ansible playbooks as selvam user with sudo option. Here is playbook file contents. playbook.yml ---
**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\ **Post date:** [March 21, 2016, 5:28pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/2 "2016-03-21T17:28:26Z")
2 things: 1. Ansible requires FULL sudo access, i.e selvam ALL=(ALL) NOPASSWD: ALL 1. You may also need to allow sudo for this user to not require a tty: Defaults:selvam !requiretty ---
**Author:** ![Calhoun\_Matt](https://avatars.discourse-cdn.com/v4/letter/c/ecb155/32.png) [@Calhoun\_Matt](https://forum.ansible.com/u/Calhoun_Matt)\ **Post date:** [March 21, 2016, 6:28pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/3 "2016-03-21T18:28:21Z")
Is there really no way to give the ansible user specific sudo NOPASSWD privileges? This seems like a huge security hole! ---
**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\ **Post date:** [March 22, 2016, 4:51pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/4 "2016-03-22T16:51:22Z")
It’s no more a security role than allowing your sysadmins to su to root… ---
**Author:** ![Calhoun\_Matt](https://avatars.discourse-cdn.com/v4/letter/c/ecb155/32.png) [@Calhoun\_Matt](https://forum.ansible.com/u/Calhoun_Matt)\ **Post date:** [March 22, 2016, 6:30pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/5 "2016-03-22T18:30:33Z")
I’m not sure I agree with that. With our admins, we have ssh with key + sudo with a password. With this setup (running ansible as a deploy user to deploy a web app), the only protection I have is the ssh key. Is there a good reason the ansible user can’t be restricted to specific commands via sudo? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [March 22, 2016, 6:37pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/6 "2016-03-22T18:37:30Z")
you can use ansible + sudo + sudo password, you end up with exact same security. ---
**Author:** ![Calhoun\_Matt](https://avatars.discourse-cdn.com/v4/letter/c/ecb155/32.png) [@Calhoun\_Matt](https://forum.ansible.com/u/Calhoun_Matt)\ **Post date:** [March 22, 2016, 6:46pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/7 "2016-03-22T18:46:26Z")
Sure, except that I am running ansible on an unattended deployment box (Jenkins) in this case vs real humans running interactively in the case of my admins. I'm trying to follow a policy of least privilege and grant the user only the rights to restart the nginx server as root (needs it to access port 443) since that's the only thing the user needs to do that requires privledge escalation. I'm wondering why this can't be accomplished with ansible? It seems like having to allow the deploy user to run any command (rather than just the one needed to restart the service) creates a potential security hole if that user's key is compromised. Am I missing something here? ---
**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\ **Post date:** [March 22, 2016, 6:49pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/8 "2016-03-22T18:49:25Z")
If that’s all you really need, invoke it via a “command” stanza with a passwordless sudo. Problem solved. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [March 22, 2016, 6:49pm UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/9 "2016-03-22T18:49:45Z")
The way ansible works is by running arbitrary scripts (modules) on the remote machine, as such it is very hard to make sudo rules to allow this that are virtually equivalent to ALL. ---
**Author:** ![selvam\_vasu](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@selvam\_vasu](https://forum.ansible.com/u/selvam_vasu)\ **Post date:** [March 23, 2016, 6:17am UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/10 "2016-03-23T06:17:08Z")
Hi Uditha, I can use “command” module to accomplish my “sudo apt-get install nginx” task, But I want to schedule my play-book to run on every half hour to maintain configuration in my client. In this case, it always will try to install nginx every time. But if I use apt module, it will install the nginx package if it is not installed or doesn’t have latest only. How can we get the same using command module. But a/w it is not a straight method. ---
**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\ **Post date:** [March 23, 2016, 11:40am UTC](https://forum.ansible.com/t/ansible-become-option-with-passwordless/20940/11 "2016-03-23T11:40:32Z")
apt-get is already idempotent: e.g. vagrant@precise64:~$ sudo apt-get install nginx -y Reading package lists… Done Building dependency tree Reading state information… Done nginx is already the newest version. 0 upgraded, 0 newly installed, 0 to remove and 189 not upgraded. vagrant@precise64:~$ sudo apt-get install nginx -y Reading package lists… Done Building dependency tree Reading state information… Done nginx is already the newest version. 0 upgraded, 0 newly installed, 0 to remove and 189 not upgraded. If you’re concerned that it might “silently” upgrade you, specify “=versionnumber” to prevent that.