# ansible now supports su as an alternative to sudo **URL:** \ **Category:** Ansible Project\ **Created:** [January 21, 2014, 6:03pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393 "2014-01-21T18:03:22Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [January 21, 2014, 6:03pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/1 "2014-01-21T18:03:22Z")
Thanks to Paul for this one! Basic usage is similar to sudo … - hosts: [el6.lab.net](http://el6.lab.net) gather\_facts: False su: yes su\_user: root tasks: - shell: whoami or pass as command line parameters … ansible-playbook --su --su-user=root --ask-su-pass -i inventory site.yml ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [January 21, 2014, 6:13pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/2 "2014-01-21T18:13:40Z")
just curious, can sudo and su be used simultaneously? ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [January 21, 2014, 6:15pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/3 "2014-01-21T18:15:56Z")
​Is that suception?​ ---
**Author:** ![adam2](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@adam2](https://forum.ansible.com/u/adam2)\ **Post date:** [January 24, 2014, 1:38am UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/4 "2014-01-24T01:38:12Z")
This doesn’t work with the git module. If I use sudo:true and sudo\_user: {{item.owner}, then the git module does the correct thing. However, If I do su:true and su\_user: {{item.owner}}, then the git module continues to run as root(I am connecting remotely as root for my playbook). I haven’t tested this on other modules. ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [January 24, 2014, 3:36am UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/5 "2014-01-24T03:36:54Z")
Please show the -vvvv output from ansible-playbook and file a bug on github. ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [January 24, 2014, 3:46pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/6 "2014-01-24T15:46:12Z")
I’m looking at this as well, and believe that I may have identified and fixed the issue. I’m going to talk it over with Paul (angstwad) for validation and testing. ---
**Author:** ![adam2](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@adam2](https://forum.ansible.com/u/adam2)\ **Post date:** [January 24, 2014, 5:24pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/7 "2014-01-24T17:24:23Z")
The following playbook doesn't do what I think it should. The su on the task stays as root. I was asked to file a bug; I could still do so. But if you think you have a handle on it, then it might just be better to past this here. cmd: ansible-playbook -i hosts.txt su-for-task-broken.yml -vvvv == hosts.txt localhost ansible\_ssh\_pass=xxxxxxxx current\_user=adam == su-for-task-broken.yml - hosts: localhost    remote\_user: root    tasks:      - name: sudo test        sudo: true        sudo\_user: "{{ current\_user }}"        shell: whoami        register: sudo\_test\_result      - name: su test        su: true        su\_user: "{{ current\_user }}"        shell: whoami        register: su\_test\_result      - name: debug        debug: var=sudo\_test\_result      - name: sudo test check        fail: msg="sudo didn't change to the correct user"        when: sudo\_test\_result.stdout != current\_user      - name: su test check        fail: msg="su didn't change to the correct user"        when: sudo\_test\_result.stdout != current\_user ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [January 24, 2014, 5:37pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/8 "2014-01-24T17:37:09Z")
Adam, See the pull request that was just submitted: [https://github.com/ansible/ansible/pull/5751](https://github.com/ansible/ansible/pull/5751) That should resolve your issue. If you are up to testing it, please do so and let us know if it resolves your issue. ---
**Author:** ![Paul\_Durivage](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@Paul\_Durivage](https://forum.ansible.com/u/Paul_Durivage)\ **Post date:** [January 24, 2014, 5:42pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/9 "2014-01-24T17:42:25Z")
Hi Adam, Thanks for reporting this. I submitted a PR this morning based on your issue. [https://github.com/ansible/ansible/pull/5751](https://github.com/ansible/ansible/pull/5751) ---
**Author:** ![adam2](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@adam2](https://forum.ansible.com/u/adam2)\ **Post date:** [January 24, 2014, 5:46pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/10 "2014-01-24T17:46:15Z")
Yup, see it, installed it, tried it, commented. ---
**Author:** ![George\_Simpson](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@George\_Simpson](https://forum.ansible.com/u/George_Simpson)\ **Post date:** [April 30, 2014, 1:52am UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/11 "2014-04-30T01:52:09Z")
Thanks for this feature, I absolutely need it. I do seem to have an issue using it. I am using ansible 1.6 (devel eb090ad4a2) on RHEL 6. When I use su with the copy module I get a permission denied error. I use a remote user to login to the server then su to another acccount. This is required in my environment. The remote user has no home directory so I have remote\_tmp set in my ansible.cfg to /tmp/.ansible/tmp. It appears that the su user doesn’t have permission to .ansible/tmp created by the remote user. I saw this [issue](https://github.com/ansible/ansible/issues/2837) that is similar, but I could not find anything specifically for su. Should I file a bug for this? ansible command line: ansible-playbook upgrade.yml -i hosts.yml -u remoteuser -k -S -R a\_user --ask-su-pass Output: fatal: hostname] =\> failed to parse: SUDO-SUCCESS-ulnzuflbdcdwddmombacdjeerhjdfgoy {“msg”: “Could not replace file: /tmp/.ansible/tmp/ansible-tmp-1398820873.22-273887835083885/source to /opt/local-data/apphome/caches/remove\_me.txt: [Errno 13] Permission denied: ‘/tmp/.ansible/tmp/ansible-tmp-1398820873.22-273887835083885/source’”, “failed”: true} Exception OSError: (2, ‘No such file or directory’, ‘/opt/local-data/apphome/caches/.ansible\_tmpzRLO88remove\_me.txt’) in \\> ignored ```auto fatal: [vsin3u544.svr.us.jpmchase.net] => failed to parse: SUDO-SUCCESS-ulnzuflbdcdwddmombacdjeerhjdfgoy {"msg": "Could not replace file: /tmp/.ansible/tmp/ansible-tmp-1398820873.22-273887835083885/source to /opt/adtools-local-data/jira8/jira_home/c aches/remove_me.txt: [Errno 13] Permission denied: '/tmp/.ansible/tmp/ansible-tmp-1398820873.22-273887835083885/source'", "failed": true} Exception OSError: (2, 'No such file or directory', '/opt/adtools-local-data/jira8/jira_home/caches/.ansible_tmpzRLO88remove_me.txt') in ', mode 'w+b' at 0x7fd090bbbdb0>> ignored ``` ```auto fatal: [vsin3u544.svr.us.jpmchase.net] => failed to parse: SUDO-SUCCESS-ulnzuflbdcdwddmombacdjeerhjdfgoy {"msg": "Could not replace file: /tmp/.ansible/tmp/ansible-tmp-1398820873.22-273887835083885/source to /opt/adtools-local-data/jira8/jira_home/c aches/remove_me.txt: [Errno 13] Permission denied: '/tmp/.ansible/tmp/ansible-tmp-1398820873.22-273887835083885/source'", "failed": true} Exception OSError: (2, 'No such file or directory', '/opt/adtools-local-data/jira8/jira_home/caches/.ansible_tmpzRLO88remove_me.txt') in ', mode 'w+b' at 0x7fd090bbbdb0>> ignored ``` ---
**Author:** ![Paul\_Durivage](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@Paul\_Durivage](https://forum.ansible.com/u/Paul_Durivage)\ **Post date:** [May 1, 2014, 1:56pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/12 "2014-05-01T13:56:44Z")
Hi George, Since I’m responsible for this feature, its edge cases, and bugs ☹ I’ll see what I can do to replicate your issue. I may or may not be able to get to it before the weekend but I’ll follow up. I thought I tested for this scenario but I may have missed it. ---
**Author:** ![George\_Simpson](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@George\_Simpson](https://forum.ansible.com/u/George_Simpson)\ **Post date:** [May 1, 2014, 9:11pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/13 "2014-05-01T21:11:39Z")
Thanks for any help you can give. Let me know if you need any more info. I also see it happening in the template module: {“msg”: “Could not replace file: /tmp/.ansible/tmp/ansible-tmp-1398978322.77-92955034866020/source to /opt/adtools-local-data/jira8/atlassian-jira-6.2.3-standalone/conf/server.xml: [Errno 13] Permission denied: ‘/tmp/.ansible/tmp/ansible-tmp-1398978322.77-92955034866020/source’”, “failed”: true} Exception OSError: (2, ‘No such file or directory’, ‘/opt/adtools-local-data/jira8/atlassian-jira-6.2.3-standalone/conf/.ansible\_tmpf2zuKKserver.xml’) in \\> ignored ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 1, 2014, 9:17pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/14 "2014-05-01T21:17:24Z")
This seems to be a reply to a post back on January 24th on commit that’s already merged in. I’m thinking this may be due to Google clearing out some spam backlog that wasn’t spam. Should be ignorable, yes? Let me know if not and this was posted today. Thanks! ---
**Author:** ![George\_Simpson](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@George\_Simpson](https://forum.ansible.com/u/George_Simpson)\ **Post date:** [May 2, 2014, 1:21pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/15 "2014-05-02T13:21:58Z")
Hi Michael, I posted about a problem using copy and template module with su on Apr 29th with ansible 1.6. I probably posted it wrong, I don’t get out much. Should I have replied to the last message in the thread instead of the first? I also wondered if it was ok to leave all the original quote in or if I should trim it down. My apologies for making you teach me how to use Google Groups. ---
**Author:** ![George\_Simpson](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@George\_Simpson](https://forum.ansible.com/u/George_Simpson)\ **Post date:** [May 9, 2014, 9:09pm UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/16 "2014-05-09T21:09:02Z")
Hi Paul, Anything I can do to help with this? I am starting a sprint next week and will be feeling the pain if I can’t use ansible to support our work. I am happy to try and find the issue in source, not so happy to try and edit Python code. I didn’t want to duplicate work if you were already looking at it. Thanks again for your help! ---
**Author:** ![George\_Simpson](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@George\_Simpson](https://forum.ansible.com/u/George_Simpson)\ **Post date:** [May 21, 2014, 5:17am UTC](https://forum.ansible.com/t/ansible-now-supports-su-as-an-alternative-to-sudo/14393/17 "2014-05-21T05:17:38Z")
I have a workaround for this. Posted the details in ansible developer list since it involves code changes. [https://groups.google.com/forum/#!topic/ansible-devel/bquhK9YSfQc](https://groups.google.com/forum/#!topic/ansible-devel/bquhK9YSfQc)