# ansible facts on hardened servers etc 0711

**URL:** <https://forum.ansible.com/t/ansible-facts-on-hardened-servers-etc-0711/26502>\
**Category:** Ansible Project\
**Created:** [January 17, 2018, 3:37pm UTC](https://forum.ansible.com/t/ansible-facts-on-hardened-servers-etc-0711/26502 "2018-01-17T15:37:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![George\_V](https://avatars.discourse-cdn.com/v4/letter/g/ac8455/32.png) [@George\_V](https://forum.ansible.com/u/George_V)\
**Post date:** [January 17, 2018, 3:37pm UTC](https://forum.ansible.com/t/ansible-facts-on-hardened-servers-etc-0711/26502/1 "2018-01-17T15:37:26Z")

</div>

In a shared-hosting environment it is important to give out as little info as possible to the users. For this purpose, permissions on most folders under / = 0711 . With /etc 0755, I can pull ansible facts, however with 0711 I get ‘NA’. Under root user there is no issue, but configuration of sshd does not allow me to log in as root. Sure, I could use ‘-b’ and resolve the issue, but that’s a workaround and not a fix. With 0711 a user cannot list directory contents but if the path to a file is known, content can be read.

How does ansible figure out what distro/version is running? From what I see under /usr/lib/python2.6/site-packages/ansible/ , platform.linux\_distribution is being used ? Strace for that function shows that it tries to list the contents of /etc ?

user $ strace python -c ‘import platform; print(platform.linux\_distribution())’  
[…]  
open(“/etc”, O\_RDONLY|O\_NONBLOCK|O\_DIRECTORY|O\_CLOEXEC) = -1 EACCES (Permission denied)  
fstat(1, {st\_mode=S\_IFCHR|0620, st\_rdev=makedev(136, 12), …}) = 0  
mmap(NULL, 4096, PROT\_READ|PROT\_WRITE, MAP\_PRIVATE|MAP\_ANONYMOUS, -1, 0) = 0x7f11acbad000  
write(1, “(‘’, ‘’, ‘’)\n”, 13(‘’, ‘’, ‘’)

Thank you

rooti# ansible pxe1 -m setup -a “filter=ansible\_distribution\*” -u user\_that\_has\_sudo\_privileges  
pxe1 | SUCCESS =\> {  
“ansible\_facts”: {  
“ansible\_distribution”: “CentOS”,  
“ansible\_distribution\_file\_parsed”: true,  
“ansible\_distribution\_file\_path”: “/etc/redhat-release”,  
“ansible\_distribution\_file\_variety”: “RedHat”,  
“ansible\_distribution\_major\_version”: “6”,  
“ansible\_distribution\_release”: “Final”,  
“ansible\_distribution\_version”: “6.9”  
},  
“changed”: false,  
“failed”: false  
}

/etc 0711:

pxe1 | SUCCESS =\> {  
“ansible\_facts”: {  
“ansible\_distribution”: “CentOS”,  
“ansible\_distribution\_file\_parsed”: true,  
“ansible\_distribution\_file\_path”: “/etc/redhat-release”,  
“ansible\_distribution\_file\_variety”: “RedHat”,  
“ansible\_distribution\_major\_version”: “NA”,  
“ansible\_distribution\_release”: “NA”,  
“ansible\_distribution\_version”: “NA”  
},  
“changed”: false,  
“failed”: false  
}