Ansible Privilege Escalation

Archives Ansible Project
1

Hello Everyone,

Below is a play that i have written to execute the task as a sudo user.

  • name: Testing the sudo user concept in this play
    hosts: all

user: ved

become: yes
become_method: su
become_pass: root_123

tasks:

  • name: edits the contents of the file this task will execute only as a root user
    lineinfile: dest=/root/sample.txt state=present insertafter=‘EOF’ line=‘GAURAV’ regexp=‘MONA’

become: yes

become_method: su

become_pass: root_123

The problem :

The “become_pass” does not work in case of a play , but works fine in case of a task.
Could anyone help me out with this?
Our task is to run the playbook on click of a button in GUI ,so we cannot go by the method of prompting for password.
And also to mention we have multiple tasks to be executed and hence want to apply the become_pass for a play and just a task(like i mentioned in case of a task it works fine.)

Thanks in advance,
Mona G

2

What version of ansible?

I just removed this in 2.0 as I thought it was an oversite (i cringed
at passwords embedded in playbooks), but I will reconsider if a good
case can be made for the feature.

3

Hi, you could use Vault instead of using plain text ROOT passwords … That’s extremely dangerous …

IMHO, there’s never a need to set it in a file, other than in Vault which is encrypted, of course :wink: … Just my thoughts.

Alex

4

I’m currently using ansible 1.9.2