# apt module fails with non-root sudoer ("Permission denied") **URL:** \ **Category:** Ansible Project\ **Created:** [October 15, 2015, 3:50pm UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516 "2015-10-15T15:50:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Kevin\_Jaquier](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@Kevin\_Jaquier](https://forum.ansible.com/u/Kevin_Jaquier)\ **Post date:** [October 15, 2015, 3:50pm UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/1 "2015-10-15T15:50:21Z")
I’m having trouble executing my script from a user with sudo access instead of root. I’m getting “permission denied” errors when playing the playbook, but if I execute the commands manually on the server it works just fine. I did use “become” to execute the tasks with sudo and the right user. The (relevant part of the) playbook : ` ---
**Author:** ![Santosh\_Jambhlikar](https://avatars.discourse-cdn.com/v4/letter/s/7c8e57/32.png) [@Santosh\_Jambhlikar](https://forum.ansible.com/u/Santosh_Jambhlikar)\ **Post date:** [October 16, 2015, 8:08am UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/2 "2015-10-16T08:08:32Z")
I use following which works for me sudo: yes but user has sudo to ALL prilvilges ---
**Author:** ![Kevin\_Jaquier](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@Kevin\_Jaquier](https://forum.ansible.com/u/Kevin_Jaquier)\ **Post date:** [October 16, 2015, 2:55pm UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/3 "2015-10-16T14:55:21Z")
That’s what I’m doing here, as the “sudo” option have been deprecated in favor of “become”. And my user also have all the privileges (see the output of “sudo -l”). At least if I understand correctly. Anyway it do have the required privilege I can “sudo apt-get install” something with this user and it works. ---
**Author:** ![Santosh\_Jambhlikar](https://avatars.discourse-cdn.com/v4/letter/s/7c8e57/32.png) [@Santosh\_Jambhlikar](https://forum.ansible.com/u/Santosh_Jambhlikar)\ **Post date:** [October 16, 2015, 3:57pm UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/4 "2015-10-16T15:57:10Z")
Try removing all parameters and add “sudo: yes” only ( like below) ---
**Author:** ![Kevin\_Jaquier](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@Kevin\_Jaquier](https://forum.ansible.com/u/Kevin_Jaquier)\ **Post date:** [October 16, 2015, 4:37pm UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/5 "2015-10-16T16:37:43Z")
I tried and it worked, obviously, because the task is actually run with root (instead of my user with sudo access) which is not what I wanted. That’s why I’m using “become\_user” (equivalent of the now deprecated “sudo\_user”), in order to use sudo with my user and not root. Below the Ansible output : $ ansible-playbook -K -i test site.yml -vvvv SUDO password: PLAY [all] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<[the server name]\> ESTABLISH CONNECTION FOR USER: [the user name] \<[the server name]\> REMOTE\_MODULE setup \<[the server name]\> EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/home/kevin/.ansible/cp/ansible-ssh-%h-%p-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=[the user name] -o ConnectTimeout=10 [the server name] /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1445011786.98-96385272343300 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1445011786.98-96385272343300 && echo $HOME/.ansible/tmp/ansible-tmp-1445011786.98-96385272343300’ \<[the server name]\> PUT /tmp/tmpzsyZR5 TO /home/[the user name]/.ansible/tmp/ansible-tmp-1445011786.98-96385272343300/setup \<[the server name]\> EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/home/kevin/.ansible/cp/ansible-ssh-%h-%p-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=[the user name] -o ConnectTimeout=10 [the server name] /bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=xlkvnygczvuuuxouqlysjwveacqafobo] password: " -u root /bin/sh -c '”’“‘echo BECOME-SUCCESS-xlkvnygczvuuuxouqlysjwveacqafobo; LANG=C LC\_CTYPE=C /usr/bin/python /home/[the user name]/.ansible/tmp/ansible-tmp-1445011786.98-96385272343300/setup; rm -rf /home/[the user name]/.ansible/tmp/ansible-tmp-1445011786.98-96385272343300/ \>/dev/null 2\>&1’”‘"’’ ok: [[the server name]] TASK: [Install useful system tools] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<[the server name]\> ESTABLISH CONNECTION FOR USER: [the user name] \<[the server name]\> REMOTE\_MODULE apt name=vim,nano,htop,git,subversion,tig,ncdu,nodejs-legacy,npm,mesa-utils state=present \<[the server name]\> EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/home/kevin/.ansible/cp/ansible-ssh-%h-%p-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=[the user name] -o ConnectTimeout=10 [the server name] /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1445011796.4-117959804841916 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1445011796.4-117959804841916 && echo $HOME/.ansible/tmp/ansible-tmp-1445011796.4-117959804841916’ \<[the server name]\> PUT /tmp/tmpDRxOC1 TO /home/[the user name]/.ansible/tmp/ansible-tmp-1445011796.4-117959804841916/apt \<[the server name]\> EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/home/kevin/.ansible/cp/ansible-ssh-%h-%p-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=[the user name] -o ConnectTimeout=10 [the server name] /bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=zkgarkbubgpvcowmyibknwzfzyeoksnf] password: " -u root /bin/sh -c '”’“‘echo BECOME-SUCCESS-zkgarkbubgpvcowmyibknwzfzyeoksnf; LANG=C LC\_CTYPE=C /usr/bin/python /home/[the user name]/.ansible/tmp/ansible-tmp-1445011796.4-117959804841916/apt; rm -rf /home/[the user name]/.ansible/tmp/ansible-tmp-1445011796.4-117959804841916/ \>/dev/null 2\>&1’”‘"’’ changed: [[the server name]] =\> ---
**Author:** ![Markus\_Ellers](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@Markus\_Ellers](https://forum.ansible.com/u/Markus_Ellers)\ **Post date:** [October 18, 2015, 8:37am UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/6 "2015-10-18T08:37:22Z")
If you combine become\_user with sudo: yes it will do what you want. You can leave sudo\_user out. ---
**Author:** ![Kevin\_Jaquier](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@Kevin\_Jaquier](https://forum.ansible.com/u/Kevin_Jaquier)\ **Post date:** [October 20, 2015, 11:10am UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/7 "2015-10-20T11:10:36Z")
“ERROR: sudo params (“become”, “become\_user”) and su params (“sudo”, “sudo\_user”) cannot be used together” However, it will indeed do what I want if I combine “become: yes” with become\_user (as “become” is a replacement for “sudo”, see [http://docs.ansible.com/ansible/become.html](http://docs.ansible.com/ansible/become.html)). That’s exactly what I was doing in the first place. The issue, which is why I’m posting here, is that by doing this I got a “Permission denied” error, even though I DO have the permissions as I can do it manually on an SSH terminal with the same user. ---
**Author:** ![Markus\_Ellers](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@Markus\_Ellers](https://forum.ansible.com/u/Markus_Ellers)\ **Post date:** [October 20, 2015, 8:41pm UTC](https://forum.ansible.com/t/apt-module-fails-with-non-root-sudoer-permission-denied/19516/8 "2015-10-20T20:41:57Z")
ah, sorry about that. You would have to use sudo on the task and become on the overall play. You can not user both “side by side”. But you are right, you can and should achieve that without the old sudo stuff, I only suggested that because it works for me right now. Now, I went back and tried to achieve the same thing using only the become params (ssh into other machine, su to another user and execute sudo commands as this user). unfortunately I was not able to achieve this. The only way was to specify the use of sudo as part of a command/shell/raw command. but not as a parameter to a task :-/ It seems that ansible expects the remote user to have all the sudo rights or directly su to a user having the proper rights.