# become\_user question **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [May 6, 2015, 5:53pm UTC](https://forum.ansible.com/t/become-user-question/18173 "2015-05-06T17:53:54Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![watsonb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/watsonb/32/309_2.png) [@watsonb](https://forum.ansible.com/u/watsonb)\ **Post date:** [May 6, 2015, 5:53pm UTC](https://forum.ansible.com/t/become-user-question/18173/1 "2015-05-06T17:53:54Z")
First some background info: - Using Ansible 1.9.0.1 - All hosts are Ubuntu 14.04 - My Ansible-fu level: novice (couple/few weeks of use) I’m trying to cobble together a streamlined development system using Jenkins + Ansible. I’ve made a lot of headway thus far, but am running into an unexpected behavior that has me stumped. I have a host named devops-ansible and another host named devops-db. On these hosts, I have user accounts for myself (ben). Using Ansible, I created an account named jenkins on both machines that is a service account meant to run a jenkins-slave program that will communicate to a master CI server. I’ve got passwordless SSH working (e.g. SSH certs) between the hosts working for both users (ben and jenkins). Furthermore, there is an entry in /etc/sudoers for the jenkins group to be able to use passwordless sudo for all commands on both hosts: - i.e.: `%jenkins ALL = NOPASSWD: ALL` Where I first ran into this problem was installing a Postgres database on devops-db via a playbook executed by jenkins on devops-ansible. When the playbook runs, it can connect to devops-db just fine and used the apt module to install Postgres without issue by setting sudo to yes in the task (but I don’t have to run the play with --ask-sudo-pass). However, I’m at that point where I need to add database users as the user postgres, which was created by virtue of installing the database. I’ve tried every combination of sudo/sudo\_user and become/become\_user/become\_method that I can think of an consistently run into the following errors: - The majority of the time, I observe: “Missing become password” on stdout of devops-ansible - If I change become\_method to su, then it appears to hang (presumably waiting for password input?) and I have to kill it via CTRL+C To illustrate the behavior, I created a series of simple “whoami” tasks as follows: ` - name: Normal Task command: /usr/bin/whoami register: n\_task - debug: var=n\_task - name: Sudo Task command: /usr/bin/whoami sudo: yes register: s\_task - debug: var=s\_task - name: Privilege Escalation Task command: /usr/bin/whoami become: yes become\_user: “{{postgresql\_admin\_user}}” become\_method: sudo register: pe\_task - debug: var=pe\_task ` Note: the variable postgresql\_admin\_user resolves to postgres Below is the stdout as observed when run as jenkins on devops-ansible ` TASK: [anxs-postgresql | Normal Task] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: jenkins REMOTE\_MODULE command /usr/bin/whoami EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1430932819.87-66566461752335 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1430932819.87-66566461752335 && echo $HOME/.ansible/tmp/ansible-tmp-1430932819.87-66566461752335’ PUT /tmp/tmphNhLih TO /var/lib/jenkins/.ansible/tmp/ansible-tmp-1430932819.87-66566461752335/command EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘LANG=C LC\_CTYPE=C /usr/bin/python /var/lib/jenkins/.ansible/tmp/ansible-tmp-1430932819.87-66566461752335/command; rm -rf /var/lib/jenkins/.ansible/tmp/ansible-tmp-1430932819.87-66566461752335/ \>/dev/null 2\>&1’ changed: [devops-db] =\> {“changed”: true, “cmd”: [“/usr/bin/whoami”], “delta”: “0:00:00.003596”, “end”: “2015-05-06 12:20:20.489499”, “rc”: 0, “start”: “2015-05-06 12:20:20.485903”, “stderr”: “”, “stdout”: “jenkins”, “warnings”: } TASK: [anxs-postgresql | debug var=n\_task] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: jenkins ok: [devops-db] =\> { “var”: { “n\_task”: { “changed”: true, “cmd”: [ “/usr/bin/whoami” ], “delta”: “0:00:00.003596”, “end”: “2015-05-06 12:20:20.489499”, “invocation”: { “module\_args”: “/usr/bin/whoami”, “module\_name”: “command” }, “rc”: 0, “start”: “2015-05-06 12:20:20.485903”, “stderr”: “”, “stdout”: “jenkins”, “stdout\_lines”: [ “jenkins” ], “warnings”: } } } TASK: [anxs-postgresql | Sudo Task] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: jenkins REMOTE\_MODULE command /usr/bin/whoami EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1430932820.05-171310724077328 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1430932820.05-171310724077328 && echo $HOME/.ansible/tmp/ansible-tmp-1430932820.05-171310724077328’ PUT /tmp/tmpfRaznB TO /var/lib/jenkins/.ansible/tmp/ansible-tmp-1430932820.05-171310724077328/command EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=pozuyfielrfgovoplpbakzjuflxuzboo] password: " -u root /bin/sh -c '”’“‘echo BECOME-SUCCESS-pozuyfielrfgovoplpbakzjuflxuzboo; LANG=C LC\_CTYPE=C /usr/bin/python /var/lib/jenkins/.ansible/tmp/ansible-tmp-1430932820.05-171310724077328/command; rm -rf /var/lib/jenkins/.ansible/tmp/ansible-tmp-1430932820.05-171310724077328/ \>/dev/null 2\>&1’”‘"’’ changed: [devops-db] =\> {“changed”: true, “cmd”: [“/usr/bin/whoami”], “delta”: “0:00:00.010214”, “end”: “2015-05-06 12:20:20.832838”, “rc”: 0, “start”: “2015-05-06 12:20:20.822624”, “stderr”: “”, “stdout”: “root”, “warnings”: } TASK: [anxs-postgresql | debug var=s\_task] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: jenkins ok: [devops-db] =\> { “var”: { “s\_task”: { “changed”: true, “cmd”: [ “/usr/bin/whoami” ], “delta”: “0:00:00.010214”, “end”: “2015-05-06 12:20:20.832838”, “invocation”: { “module\_args”: “/usr/bin/whoami”, “module\_name”: “command” }, “rc”: 0, “start”: “2015-05-06 12:20:20.822624”, “stderr”: “”, “stdout”: “root”, “stdout\_lines”: [ “root” ], “warnings”: } } } TASK: [anxs-postgresql | Privilege Escalation Task] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: jenkins REMOTE\_MODULE command /usr/bin/whoami EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘mkdir -p /tmp/ansible-tmp-1430932820.42-42861004344608 && chmod a+rx /tmp/ansible-tmp-1430932820.42-42861004344608 && echo /tmp/ansible-tmp-1430932820.42-42861004344608’ PUT /tmp/tmptC6NoD TO /tmp/ansible-tmp-1430932820.42-42861004344608/command EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘chmod a+r /tmp/ansible-tmp-1430932820.42-42861004344608/command’ EXEC ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“/var/lib/jenkins/.ansible/cp/%h-%r” -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 devops-db /bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=jbwdiylloxvtejdifemgantwsahulmsr] password: " -u postgres /bin/sh -c '”’“‘echo BECOME-SUCCESS-jbwdiylloxvtejdifemgantwsahulmsr; LANG=C LC\_CTYPE=C /usr/bin/python /tmp/ansible-tmp-1430932820.42-42861004344608/command’”‘"’’ fatal: [devops-db] =\> Missing become password FATAL: all hosts have already failed – aborting ` The SSH session below should illustrate that, at the OS level, my users are good to go privilege-wise: ` ben@devops-ansible:~/Development/ansible-playbooks/BenDevEnv$ sudo su - jenkins [sudo] password for ben: jenkins@devops-ansible:~$ ssh devops-db Welcome to Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-49-generic i686) - Documentation: [https://help.ubuntu.com/](https://help.ubuntu.com/) 63 packages can be updated. 55 updates are security updates. Last login: Wed May 6 12:20:20 2015 from laptop jenkins@devops-db:~$ sudo su postgres postgres@devops-db:/var/lib/jenkins$ ` Any advice? v/r Ben ---
**Author:** ![watsonb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/watsonb/32/309_2.png) [@watsonb](https://forum.ansible.com/u/watsonb)\ **Post date:** [May 6, 2015, 7:49pm UTC](https://forum.ansible.com/t/become-user-question/18173/2 "2015-05-06T19:49:05Z")
So I may have solved my own problem. I’ll go ahead and post my results here for completeness sake. I found a nice role definition for postgres on GitHub that I’m adapting for my own use (this is one of the things I love about Ansible). One of the tasks in the role looked like this originally: ` - name: PostgreSQL | Make sure the PostgreSQL users are present postgresql\_user: name: “{{item.name}}” password: “{{item.pass | default(‘pass’)}}” port: “{{postgresql\_port}}” state: present login\_user: “{{postgresql\_admin\_user}}” sudo: yes sudo\_user: “{{postgresql\_admin\_user}}” with\_items: postgresql\_users when: postgresql\_users|length \> 0 ` This (and a series of tasks that attempted priviledge escalation for the postgresql\_user module) would throw the “Missing become password” error. I changed the above task by substituting sudo syntax with become syntax in hopes I could try different become\_method options to no avail. As it turns out, I’ve removed both the sudo and become constructs from this task and it executed fine. But, I don’t know why it executed fine. v/r Ben