# \`ansible\_ssh\_user\` overriding \`remote\_user\`

**URL:** <https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [July 30, 2014, 10:04pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816 "2014-07-30T22:04:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steven\_Ringo](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@Steven\_Ringo](https://forum.ansible.com/u/Steven_Ringo)\
**Post date:** [July 30, 2014, 10:04pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/1 "2014-07-30T22:04:19Z")

</div>

Hi,

I seem to be having issues when `remote_user` is used in conjunction with `ansible_ssh_user`

For this playbook:

```auto
- hosts: tag_application_csds
  tasks:
    - command: "whoami"
      remote_user: deploy
      register: whoami
    - debug: var=whoami.stdout

```

with `group_vars/tag_application_csds`:

```auto
ansible_ssh_private_key_file: ~/.ssh/identity.ec2
ansible_ssh_user: ubuntu

```

If I run `$ ansible-playbook test.yml` (no other arguments), I get:

```auto
ok: [1.1.1.1] => {
    "whoami.stdout": "ubuntu"
}

```

This despite the `remote_user: deploy` parameter on the task.

If delete the `ansible_ssh_user` parameter from the `group_vars` file and run `$ ansible-playbook test.yml -u ubuntu`, I get as expected:

```auto
ok: [1.1.1.1] => {
    "whoami.stdout": "deploy"
}

```

It seems like `ansible_ssh_user` overrides `remote_user` used in the playbook.

Is this desired behaviour? If so, it seems counterintuitive to me. If its a bug then I will lodge it.

On different, but related note, are there any benefits/differences in playbook behaviour when using `remote_user` than using `sudo_user`? Seems that for `remote_user` to work, the user must have credentials that allow it to be logged in from the terminal.

Thanks so much,

Steve

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [July 30, 2014, 10:29pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/2 "2014-07-30T22:29:18Z")

</div>

I believe it’s intended that the inventory parameter always be used if set.

I’d have to go back through the vast archives to verify the logic, but in general, usually things work the way they have evolved for concrete reasons, one of those was being able to set a reasonable default but also have exceptions.

OTOH, I see the reasoning of making the play stuff “beat” inventory when set as such.

Thoughts everyone?

---

<div class="post-metadata">

**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\
**Post date:** [July 30, 2014, 11:45pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/3 "2014-07-30T23:45:52Z")

</div>

It has always been the case that inventory ‘wins’ the only way to override that is redefining ansible\_ssh\_user (either as a var or extra\_var).​

---

<div class="post-metadata">

**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\
**Post date:** [July 31, 2014, 11:11am UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/4 "2014-07-31T11:11:22Z")

</div>

​I would have expected​ that, too, though never used this combo.  
Not sure why it's not like this? Brian, are you aware of a reason?

BTW, while I could accept inventory winning here - this is some kind of  
special var that seems to me to be part of the inventory host list, more  
than general variables - I'm wondering what the logic is for  
ansible\_sudo\_user? For this one, I could understand setting a default to  
e.g. root, but that should definitely be overrideable for say a particular  
task.

&nbsp;&nbsp;Serge

---

<div class="post-metadata">

**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\
**Post date:** [July 31, 2014, 12:06pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/5 "2014-07-31T12:06:05Z")

</div>

it makes sense that the inventory variables override others, the specifics of a host should override the generalities of the plays.​

If a play has remote\_user = user1, but some hosts have different users, you would not be able to use them otherwise, with inventory overriding, this is possible.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [July 31, 2014, 1:02pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/6 "2014-07-31T13:02:46Z")

</div>

It’s a “can’t win em all” thing.

In one case, you want a way to override all behavior, in another, you want a way to set a default.

In most cases, if you make a host with a given username/pass coupled to it, it means “I really really want to use this” but you could still use other host aliases if you wanted to connect differently.

So the exception case was probably more important when I built that.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\
**Post date:** [July 31, 2014, 2:01pm UTC](https://forum.ansible.com/t/ansible-ssh-user-overriding-remote-user/15816/7 "2014-07-31T14:01:48Z")

</div>

you can still override it at run/play level, it is just not with remote\_user, you need to set/unset ansible\_ssh\_user​