# become\_user not being honored? **URL:** \ **Category:** Ansible Project\ **Created:** [May 26, 2016, 4:22pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580 "2016-05-26T16:22:32Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\ **Post date:** [May 26, 2016, 4:22pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/1 "2016-05-26T16:22:32Z")
Running Ansible 2.1. If I use sudo in front of the command, it works. if I remove and use “become\_user: root” it does not work. I’ve also tried setting “become: True” and I get the same results. Works: ```auto - name: restart web server shell: sudo /etc/init.d/aria_services restart when: install_rpm_results|success register: restart_services_result failed_when: "'FAIL' in restart_services_result.stdout" ignore_errors: True ``` Expected Results: ```auto "stdout": "Creating /web bind mounts\n=== stop ===\n== no PID means no KILL ==\nClearing wsdl and symfony cache files\n=== start ===\nQuery API OK\nNGUI API OK\nCore API OK\nAdmin API OK\nFailed ARC/VIE API\n2 attempted: 2 started, 2 stopped", "stdout_lines": [ "Creating /web bind mounts", "=== stop ===", "== no PID means no KILL ==", "Clearing wsdl and symfony cache files", "=== start ===", "Query API OK", "NGUI API OK", "Core API OK", "Admin API OK", "Failed ARC/VIE API", "2 attempted: 2 started, 2 stopped" ], ``` Does not work: ```auto - name: restart web server shell: /etc/init.d/aria_services restart when: install_rpm_results|success register: restart_services_result failed_when: "'FAIL' in restart_services_result.stdout" ignore_errors: True become_user: root ``` Actual Results: ```auto "stderr": "Password: su: Authentication information cannot be recovered\ncat: /etc/aria/services: Permission denied", "stdout": "No aria services found", ``` ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [May 26, 2016, 5:29pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/2 "2016-05-26T17:29:08Z")
become\_user only says which user to be used. To actually use become/sudo you need to add become: true become\_user default to root so you do not need to specify it if you like having less code. ---
**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\ **Post date:** [May 26, 2016, 7:05pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/3 "2016-05-26T19:05:47Z")
Ok so i removed become\_user and added “become: true” now it’s asking for a password. TASK [restart web server] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* fatal: [127.0.0.1]: FAILED! =\> {“changed”: false, “failed”: true, “module\_stderr”: “sudo: a password is required\n”, “module\_stdout”: “”, “msg”: “MODULE FAILURE”, “parsed”: false} My sudo entry shows this. %deployment ALL=(ALL) NOPASSWD: DEPLOYMENT Cmnd\_Alias DEPLOYMENT\_CMDS = /etc/init.d/aria\_services restart, /etc/init.d/aria\_services start, /etc/init.d/aria\_services stop, ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [May 26, 2016, 7:10pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/4 "2016-05-26T19:10:23Z")
Ansible requires the ability to run any command via sudo, it does not work with a restricted set of commands, as it executes python via /bin/sh. It does not directly run those commands that you have restricted that group to. ---
**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\ **Post date:** [May 26, 2016, 7:13pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/5 "2016-05-26T19:13:03Z")
Ok, so then why does it work if I add “sudo” in front of the command? Is this the become directive handles sudo differently? ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [May 26, 2016, 7:14pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/6 "2016-05-26T19:14:29Z")
And instead of allowing your user (the one ansible connects as and runs sudo) to run all commands without a password, I would rather save the sudo password in a ansible-vault encrypted file on the controller: ansible-vault edit host\_vars/foobar.yml for the host foobar, and create an entry 'become\_pass: xyz' for the password xyz. Johannes ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [May 26, 2016, 7:17pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/7 "2016-05-26T19:17:14Z")
In the case where you put `sudo` in the command, then the command ansible runs from within the python script contains sudo. In the case where you use become, and don’t put sudo in the command, the python script is being executed with sudo, and not the inner specified command itself. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [May 26, 2016, 7:18pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/8 "2016-05-26T19:18:55Z")
Because then ansible starts a shell and calls that exact command you tell it to run. And thus sudo kicks in, as the command is allowed, and runs it. Johannes ---
**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\ **Post date:** [May 26, 2016, 7:51pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/9 "2016-05-26T19:51:59Z")
So I’m kind of SOL then if Ansible removes “sudo” ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [May 26, 2016, 7:55pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/10 "2016-05-26T19:55:25Z")
I'm not sure what you mean. Why should ansible remove sudo? If you can't change the sudo policy on the target, simply use your task with the shell module. Or supply the sudo password via ansible-vault. If you can change the sudo policy, you could grant your user (or a special ansible user) the right to call all commands without passwords. The choice is yours. Johannes ---
**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\ **Post date:** [May 26, 2016, 8:00pm UTC](https://forum.ansible.com/t/become-user-not-being-honored/21580/11 "2016-05-26T20:00:00Z")
Nevermind, i misunderstood the notes on the become module page. I will continue to use shell w/ sudo.