# ansible playbook to run cmd using its root user (sudo rootsh) and password **URL:** \ **Category:** Ansible Project\ **Created:** [January 19, 2023, 2:35pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563 "2023-01-19T14:35:33Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![saravanan\_jothilinga](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@saravanan\_jothilinga](https://forum.ansible.com/u/saravanan_jothilinga)\ **Post date:** [January 19, 2023, 2:35pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/1 "2023-01-19T14:35:33Z")
Hi, I am a novice to ansible and am practising to get more hands-on. I am trying one usecase where I need to connect to a remote SLES12 linux server using my id and then switch to root user and execute some tasks. While switching over to root user (_cmd:_ sudo rootsh), it prompts for a root password. When I run this usecase using ansible playbook, it gives the below error. Could you please let me know what would be correct/valid directives (become\_\*) that I need to use to run the cmd using root user. Appreciate your help. I wrote this playboo **testroot.yaml** ---
**Author:** ![saravanan\_jothilinga](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@saravanan\_jothilinga](https://forum.ansible.com/u/saravanan_jothilinga)\ **Post date:** [January 20, 2023, 6:40am UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/2 "2023-01-20T06:40:49Z")
Any update on this? ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [January 20, 2023, 1:03pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/3 "2023-01-20T13:03:01Z")
In ansible if you have become: true on a task, that task will run with elevated privileges. On Linux the default is to try sudo. You don’t need to specify become\_exe. Any command given to your shell task will run in a root privileged shell. The user ID you run the playbook as must have login access to the remote system and sudo privilege on the remote system via /etc/sudoers or a file in /etc/sudoers.d. In our environment we have some common files we populate in /etc/sudoers.d based on server function. For example, all servers we manage have a server mgmt id we use for remote mgmt and a special group for our own user IDs when we remote into those machines. We place a file in /etc/sudoers.d that grants our mgmt ID and mgmt group the rights we need. For all database servers our DBA group requires some privileges so we add an /etc/sudoers.d/dba file that controls their privileged access for members of the DBA group members. In your testroot.yaml file you can remove the become\_exe line. **testroot.yaml** ---
**Author:** ![saravanan\_jothilinga](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@saravanan\_jothilinga](https://forum.ansible.com/u/saravanan_jothilinga)\ **Post date:** [January 20, 2023, 1:31pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/4 "2023-01-20T13:31:44Z")
Thanks for your input. In the remote machine, i dont have any permission to edit any files under /etc. In this case, how to achieve the remote node execution using ‘sudo rootsh’ cmd. ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [January 20, 2023, 1:47pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/5 "2023-01-20T13:47:23Z")
Try leaving off become\_exe. If you can run sudo rootsh then your task can use sudo. When you run sudo rootsh at a command prompt does it ask for your password? If so, the ansible task also will have to respond to a password prompt. That is causing your timeout. Walter ---
**Author:** ![saravanan\_jothilinga](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@saravanan\_jothilinga](https://forum.ansible.com/u/saravanan_jothilinga)\ **Post date:** [January 23, 2023, 6:10am UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/6 "2023-01-23T06:10:45Z")
No luck ☹ I tried this use case with 2 attempts. For both the cases, the password is not taken at the ansible playbook execution time. i get the below error msg. **Note** - In the ansible.cfg, i have set **timeout = 300. Are there any extra parameters which I need to set here ?** **Attempt-1:** cat testroot.yaml ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [January 23, 2023, 11:55am UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/7 "2023-01-23T11:55:00Z")
What’s the output from ```auto sudo -l ``` on that host (as per the task “Get current user on remote” message)? ---
**Author:** ![saravanan\_jothilinga](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@saravanan\_jothilinga](https://forum.ansible.com/u/saravanan_jothilinga)\ **Post date:** [January 23, 2023, 12:20pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/8 "2023-01-23T12:20:51Z")
Hi, I get this output when I run ‘sudo -l’. I used ansible\_user=testuser in the _ **host inventory file** _ to connect to the remote server. > **sudo -l** > Subject to Corporate’s Global Employee and Global Contingent Worker Privacy Notices > (see [https://employeecontent.Corporate.com/content/corp/Global\_Employee\_and\_Global\_Contingent\_Worker\_Privacy.html](https://employeecontent.Corporate.com/content/corp/Global_Employee_and_Global_Contingent_Worker_Privacy.html) ) > all system access and delegated/privileged activity on the Corporate network > may be logged for auditing and security purposes, including your username > and commands used. Log records may be retained for up to 1 year. We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. Remember you may use ‘sudo -l’ to review a list of authorized commands. Authenticate with **testuser’s** password: Matching Defaults entries for **testuser** on testhost: syslog=local3, !set\_home, !targetpw, !insults, mailto=alert-sudo, !mail\_always, ignore\_dot, timestamp\_timeout=5, listpw=always, !lecture\_file, passprompt="Authenticate with %u’s password: ", always\_set\_home, !env\_reset, umask\_override, !root\_sudo, !tty\_tickets, fqdn, listpw=always, env\_delete+=USER\_ITOOLS, env\_delete+=PROJECT\_ITOOLS, env\_delete+=KRB5CCNAME, env\_delete+=XAUTHORITY, lecture=always, lecture\_file=/nfs/site/gen/adm/ec\_global/sudo.lecture, passprompt="Authenticate with %u’s password: ", always\_set\_home, !env\_reset, umask\_override, !root\_sudo, !tty\_tickets, fqdn, listpw=always, env\_delete+=USER\_ITOOLS, env\_delete+=PROJECT\_ITOOLS, env\_delete+=KRB5CCNAME User **testuser** may run the following commands on testhost: (root) /usr/Corporate/bin/rootsh, /usr/Corporate/bin/rootsh2, /usr/Corporate/bin/rootsh1 (root) NOPASSWD: /usr/Corporate/common/pkgs/vas-helper/1.0/exe/_/idchange (root) NOPASSWD: /usr/Corporate/common/pkgs/vas-helper/1.0/bin/krb-helper (root) /bin/cat /var/log/messages, /usr/bin/cat /var/log/messages, /bin/dmesg (kerberostest) NOPASSWD: /usr/bin/sudo /bin/date, /usr/bin/sudo -l, /usr/Corporate/bin/sudo /bin/date, /usr/Corporate/bin/sudo -l (root) NOPASSWD: /nfs/iil/gen/adm/netbatch/util/nbconfig/nbconfig (root) NOPASSWD: /nfs/iil/gen/adm/nbtools/bin/[nblock.pl](http://nblock.pl) (root) NOPASSWD: /nfs/iil/local/common/bin/lsdir.amd (root) NOPASSWD: /usr/local/common/bin/lsdir.amd (profusr) NOPASSWD: /nfs/site/gen/itec/profiling/utils/profiler/profiler\_post, /nfs/site/gen/itec/profiling/utils/profiler/benchmarking\_post (root) NOPASSWD: /usr/Corporate/common/pkgs/acctusers/CURRENT/bin/acctusers (root) NOPASSWD: /usr/Corporate/common/pkgs/acctusers/1.1/bin/acctusers (root) /nfs/site/gen/adm/ec\_global/customerSudo/SLES12SP2upgrader.sh (root) NOPASSWD: /nfs/site/gen/adm/emulation/Global/scripts/virt\_modules/startVirt.sh, /p/emulation/virt\_modules/startVirt.sh, /p/emulation/virt\_modules/start\_virt (root) NOPASSWD: /usr/Corporate/common/pkgs/vas-helper/1.0/bin/krb-helper (root) NOPASSWD: /usr/Corporate/common/pkgs/vas-helper/1.0/exe/_/idchange ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [January 23, 2023, 1:21pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/9 "2023-01-23T13:21:37Z")
> Authenticate with **testuser’s** password: THIS … you had to authenticate … the ansible playbook is also “waiting to authenticate” the sudo for testuser (become: true). That is timing out because it expects to have sudo rights without requiring a password. Walter ---
**Author:** ![saravanan\_jothilinga](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@saravanan\_jothilinga](https://forum.ansible.com/u/saravanan_jothilinga)\ **Post date:** [January 23, 2023, 1:34pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/10 "2023-01-23T13:34:49Z")
Yes Walter, you are right. I am passing the root password ( **–ask-become-pass** ) as part of the ansible playbook execution cmd. Here my ssh user pwd and root pwd are the same. **ansible-playbook -i hosts testroot.yaml -e “host=[host.iil.corp.com](http://host.iil.corp.com/)” --ask-become-pass -k** [DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the controller starting with Ansible 2.12. Current version: 3.6.15 (default, Sep 15 2021, 14:20:42) [GCC]. This feature will be removed from ansible-core in version 2.12. Deprecation warnings can be disabled by setting deprecation\_warnings=False in ansible.cfg. _ **SSH password:** _ _**BECOME password[defaults to SSH password]:**_ ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [January 24, 2023, 12:51pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/11 "2023-01-24T12:51:41Z")
Something feels not quite right with that answer. You only got the “Timeout (12s) waiting for privilege escalation prompt” timeout when you used **become\_exe: “sudo rootsh”** , which of course will never work because there is no executable named “ **sudo rootsh** ”. The other times, you were just disconnected. I believe this wasn’t because it expected no-password sudo to work, but rather because **testuser** has only a limited set of commands it’s allowed to run under sudo. These were listed in the output of “ **sudo -l** ” previously. One thing you might try is setting “ **become\_flags: rootsh** ”. I know it’s not really a flag, but we’re trying to get sudo to run rootsh — I’m guessing, based on what you showed us already. I don’t really expect it to work, but its failure may provide more information. More generally, to do Ansible right, your connecting user needs sudo capability to run any command, regardless of whether a sudo password is required. There are four distinct issues that must be considered: connection, privilege escalation, authorization, and execution. Any of those _may_ have distinct authentication components. It can be difficult to discern which one is thwarting success. ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [January 24, 2023, 1:01pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/12 "2023-01-24T13:01:09Z")
Aha! Good observation. Perhaps he should NOT “become: true” and instead include “sudo rootsh” as part of his command? Walter ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [January 24, 2023, 1:13pm UTC](https://forum.ansible.com/t/ansible-playbook-to-run-cmd-using-its-root-user-sudo-rootsh-and-password/37563/13 "2023-01-24T13:13:37Z")
[ | [Understanding privilege escalation: become — Ansible Documentation](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#privilege-escalation-must-be-general) [docs.ansible.com](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#privilege-escalation-must-be-general) | [![favicon.ico](https://us1.discourse-cdn.com/ansible/original/2X/1/1f252080a17ec1d2db236ac8c639a13e1b1770ff.png)](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#privilege-escalation-must-be-general) | ](https://docs.ansible.com/ansible/latest/playbook\_guide/playbooks\_privilege\_escalation.html#privilege-escalation-must-be-general) > You cannot limit privilege escalation permissions to certain commands. Ansible does not always use a specific command to do something but runs modules (code) from a temporary file name which changes every time. Walter