# Ansible not becoming super user **URL:** \ **Category:** Ansible Project\ **Created:** [March 22, 2016, 7:06pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959 "2016-03-22T19:06:42Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Aaron\_Axisa](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@Aaron\_Axisa](https://forum.ansible.com/u/Aaron_Axisa)\ **Post date:** [March 22, 2016, 7:06pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/1 "2016-03-22T19:06:42Z")
I have the following playbook ```auto --- - name: myPlaybook hosts: "{{machine_to_setup}}" remote_user: "{{user_to_use}}" become: yes roles: # Install Gosa - part 1 - { role: gosa, become: yes } ``` ```auto ``` ```auto ``` ```auto (I know become is duplicated. ``` ```auto With the following role content: ``` ```auto ``` ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [March 22, 2016, 7:08pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/2 "2016-03-22T19:08:20Z")
run with -vvvv to see what ansible is doing. ---
**Author:** ![Aaron\_Axisa](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@Aaron\_Axisa](https://forum.ansible.com/u/Aaron_Axisa)\ **Post date:** [March 22, 2016, 7:25pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/3 "2016-03-22T19:25:59Z")
TASK [gosa : Install EPEL Package] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /var/lib/awx/projects/\_8\_\_bitbucket\_ldap/ansible/roles/gosa/tasks/main.yml:15 \<192.168.20.4\> ESTABLISH SSH CONNECTION FOR USER: sshUser \<192.168.20.4\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \<192.168.20.4\> SSH: ANSIBLE\_HOST\_KEY\_CHECKING/host\_key\_checking disabled: (-o)(StrictHostKeyChecking=no) \<192.168.20.4\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=sshUser) \<192.168.20.4\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \<192.168.20.4\> SSH: PlayContext set ssh\_common\_args: () \<192.168.20.4\> SSH: PlayContext set ssh\_extra\_args: () \<192.168.20.4\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r) \<192.168.20.4\> SSH: EXEC sshpass -d19 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=sshUser -o ConnectTimeout=10 -o ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r -tt 192.168.20.4 ‘/bin/sh -c ‘"’"’( umask 22 && mkdir -p “`echo /tmp/ansible-tmp-1458673360.76-40131931109713`” && echo “`echo /tmp/ansible-tmp-1458673360.76-40131931109713`” )‘"’“‘’ \<192.168.20.4\> PUT /tmp/tmp79QZ0d TO /tmp/ansible-tmp-1458673360.76-40131931109713/yum \<192.168.20.4\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \<192.168.20.4\> SSH: ANSIBLE\_HOST\_KEY\_CHECKING/host\_key\_checking disabled: (-o)(StrictHostKeyChecking=no) \<192.168.20.4\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=sshUser) \<192.168.20.4\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \<192.168.20.4\> SSH: PlayContext set ssh\_common\_args: () \<192.168.20.4\> SSH: PlayContext set sftp\_extra\_args: () \<192.168.20.4\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r) \<192.168.20.4\> SSH: EXEC sshpass -d19 sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=sshUser -o ConnectTimeout=10 -o ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r ‘[192.168.20.4]’ \<192.168.20.4\> ESTABLISH SSH CONNECTION FOR USER: sshUser \<192.168.20.4\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \<192.168.20.4\> SSH: ANSIBLE\_HOST\_KEY\_CHECKING/host\_key\_checking disabled: (-o)(StrictHostKeyChecking=no) \<192.168.20.4\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=sshUser) \<192.168.20.4\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \<192.168.20.4\> SSH: PlayContext set ssh\_common\_args: () \<192.168.20.4\> SSH: PlayContext set ssh\_extra\_args: () \<192.168.20.4\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r) \<192.168.20.4\> SSH: EXEC sshpass -d19 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=sshUser -o ConnectTimeout=10 -o ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r -tt 192.168.20.4 '/bin/sh -c '”‘“‘chmod a+r /tmp/ansible-tmp-1458673360.76-40131931109713/yum’”’“‘’ \<192.168.20.4\> ESTABLISH SSH CONNECTION FOR USER: sshUser \<192.168.20.4\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \<192.168.20.4\> SSH: ANSIBLE\_HOST\_KEY\_CHECKING/host\_key\_checking disabled: (-o)(StrictHostKeyChecking=no) \<192.168.20.4\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=sshUser) \<192.168.20.4\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \<192.168.20.4\> SSH: PlayContext set ssh\_common\_args: () \<192.168.20.4\> SSH: PlayContext set ssh\_extra\_args: () \<192.168.20.4\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r) \<192.168.20.4\> SSH: EXEC sshpass -d19 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=sshUser -o ConnectTimeout=10 -o ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r -tt 192.168.20.4 '/bin/sh -c '”‘“'su machineAdmin -c '”’“'”‘"’“'”‘"’“'/bin/sh -c '”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘“‘echo BECOME-SUCCESS-lfogtfnclgywxqhqkuojrrwwqbimgrad; LANG=en\_US.UTF-8 LC\_ALL=en\_US.UTF-8 LC\_MESSAGES=en\_US.UTF-8 /usr/bin/python -tt /tmp/ansible-tmp-1458673360.76-40131931109713/yum’”’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“'”‘"’“‘’”‘"’“'”‘"’“'”‘"’‘"’“‘’ \<192.168.20.4\> ESTABLISH SSH CONNECTION FOR USER: sshUser \<192.168.20.4\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s) \<192.168.20.4\> SSH: ANSIBLE\_HOST\_KEY\_CHECKING/host\_key\_checking disabled: (-o)(StrictHostKeyChecking=no) \<192.168.20.4\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=sshUser) \<192.168.20.4\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10) \<192.168.20.4\> SSH: PlayContext set ssh\_common\_args: () \<192.168.20.4\> SSH: PlayContext set ssh\_extra\_args: () \<192.168.20.4\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r) \<192.168.20.4\> SSH: EXEC sshpass -d19 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=sshUser -o ConnectTimeout=10 -o ControlPath=/tmp/ansible\_tower\_ujAG0E/cp/ansible-ssh-%h-%p-%r -tt 192.168.20.4 '/bin/sh -c '”‘“‘rm -f -r /tmp/ansible-tmp-1458673360.76-40131931109713/ \> /dev/null 2\>&1’”’“‘’ fatal: [192.168.20.4]: FAILED! =\> {“changed”: true, “failed”: true, “invocation”: {“module\_args”: {“conf\_file”: null, “disable\_gpg\_check”: false, “disablerepo”: null, “enablerepo”: null, “exclude”: null, “install\_repoquery”: true, “list”: null, “name”: [”/tmp/epel.rpm"], “state”: “present”, “update\_cache”: false, “validate\_certs”: true}, “module\_name”: “yum”}, “msg”: “You need to be root to perform this command.\n”, “rc”: 1, “results”: [“Loaded plugins: fastestmirror\n”]} [WARNING]: Failure when attempting to use callback plugin (\): ‘unicode’ object has no attribute ‘get’ ---
**Author:** ![Brandon\_McCraw](https://avatars.discourse-cdn.com/v4/letter/b/ecc23a/32.png) [@Brandon\_McCraw](https://forum.ansible.com/u/Brandon_McCraw)\ **Post date:** [March 22, 2016, 8:13pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/4 "2016-03-22T20:13:28Z")
From what I understand of ‘become’ it only specifies that you want to allow user escalation. It doesn’t actually escalate to a super user. You’ll need to use additional directives to escalate to super-user as described here: > **Directives** > These can be set from play to task level, but are overriden by connection variables as they can be host specific. > **become** > set to ‘true’/’yes’ to activate privilege escalation. > **become\_user** > set to user with desired privileges, the user you ‘become’, NOT the user you login as. Does NOT imply , to allow it to be set at host level. > **become\_method** > at play or task level overrides the default method set in ansible.cfg, set to ‘sudo’/’su’/’pbrun’/’pfexec’/’doas’ [http://docs.ansible.com/ansible/become.html](http://docs.ansible.com/ansible/become.html) So, try this ```auto - name: myPlaybook hosts: "{{machine_to_setup}}" remote_user: "{{user_to_use}}" become: yes ``` ```auto become_user: "{{user_to_use}}" ``` ```auto become_method: sudo ``` ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [March 22, 2016, 8:34pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/5 "2016-03-22T20:34:53Z")
So in the first debug I see “su machineAdmin” which might not have access to the specific action if yum is giving you that message. @Brandon, this is useless: remote\_user: “{{user\_to\_use}}” become: yes become\_user: “{{user\_to\_use}}” ^ that is the same as writing sudo ‘myself’, the become\_user is the user you TURN INTO, the remote\_user is the one you login as and that TURNS INTO the become\_user. ---
**Author:** ![Aaron\_Axisa](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@Aaron\_Axisa](https://forum.ansible.com/u/Aaron_Axisa)\ **Post date:** [March 22, 2016, 8:47pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/6 "2016-03-22T20:47:26Z")
If i run the yum install as the machineAdmin user it is fine on the machine. Ansible is somehow losing the privledges? And it’s using su machineAdmin cause ansible tower is configured that the sshUser’s privelege escalation is of type su and with credentials for machineAdmin (In reality both machineAdmin and sshUser are sudoers and hence an execute the command) ---
**Author:** ![Benjamin\_Redling](https://avatars.discourse-cdn.com/v4/letter/b/47e85d/32.png) [@Benjamin\_Redling](https://forum.ansible.com/u/Benjamin_Redling)\ **Post date:** [March 22, 2016, 8:48pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/7 "2016-03-22T20:48:16Z")
Have you setup sshUser in sudoers for password less privilege elevation? Benjamin ---
**Author:** ![Aaron\_Axisa](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@Aaron\_Axisa](https://forum.ansible.com/u/Aaron_Axisa)\ **Post date:** [March 22, 2016, 9:12pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/8 "2016-03-22T21:12:47Z")
If i go into visudo (centos) I have the following sshUser ALL=(ALL) NOPASSWD: ALL machineAdmin ALL=(ALL) NOPASSWD: ALL so yes? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [March 22, 2016, 9:15pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/9 "2016-03-22T21:15:38Z")
I believe the issue is you are using become wrong, as per that sudoers file you can just leave the `become_user: root` and it will work logging in either as sshuser or machineadmin (also `become_method: sudo`), or just don’t set them as those are the defaults. ---
**Author:** ![Aaron\_Axisa](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@Aaron\_Axisa](https://forum.ansible.com/u/Aaron_Axisa)\ **Post date:** [March 22, 2016, 9:25pm UTC](https://forum.ansible.com/t/ansible-not-becoming-super-user/20959/10 "2016-03-22T21:25:50Z")
Updating the ansible credentials to leave out the privelege escalation worked thanks