# "/bin/sh" isn\\'t allowed to be executed **URL:** \ **Category:** Ansible Project\ **Created:** [July 12, 2017, 7:02am UTC](https://forum.ansible.com/t/bin-sh-isn-t-allowed-to-be-executed/24960 "2017-07-12T07:02:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\ **Post date:** [July 12, 2017, 7:02am UTC](https://forum.ansible.com/t/bin-sh-isn-t-allowed-to-be-executed/24960/1 "2017-07-12T07:02:42Z")
I’m trying to run commands against a remote host and even a simple ad hoc ping fails, with the error ‘“/bin/sh” isn't allowed to be executed’. The error message changes to ‘/bin/bash’ when I add “executable = /bin/bash” in ansible.cfg. Adding the -b switch makes no difference. When looging in manually ssh with the same user/key combination works just fine. The system in question is SLES11 and runs Python 2.6. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [July 12, 2017, 4:20pm UTC](https://forum.ansible.com/t/bin-sh-isn-t-allowed-to-be-executed/24960/2 "2017-07-12T16:20:56Z")
It would help if you show the commands attempted and the full error, even using -vvv to make the output verbose. ---
**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\ **Post date:** [July 12, 2017, 6:41pm UTC](https://forum.ansible.com/t/bin-sh-isn-t-allowed-to-be-executed/24960/3 "2017-07-12T18:41:21Z")
Hi Brian, The command and output is below. The thing that I find odd is that, to the best of my knowledge, ansible uses the ssh client config of user by default. The same user that runs ansible (root in this case) gets the correct username (not root) and SSH key from ~/.ssh/config and is able to log in the cost against which the ad hoc play is run. I’m wondering if there’s something funny about this host. root@WDFN34201151A:/mnt/c/Users/user/Documents/Projects/Ansible\_Playbooks/Automation# ansible -vvv -m ping control Using /mnt/c/Users/D069683/Documents/Projects/Ansible\_Playbooks/Automation/ansible.cfg as config file META: ran handlers Using module file /root/.local/lib/python2.7/site-packages/ansible/modules/system/ping.py \<[clts.rot.od.sap.biz](http://clts.rot.od.sap.biz)\> ESTABLISH SSH CONNECTION FOR USER: user \<[clts.rot.od.sap.biz](http://clts.rot.od.sap.biz)\> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=user -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/7dd2444b86 clts ‘/bin/sh -c ‘"’“‘echo ~ && sleep 0’”’“‘’ (1, ‘’, n\n”/bin/sh" isn't allowed to be executed.\n’) ESTABLISH SSH CONNECTION FOR USER: user SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=user -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/7dd2444b86 [clts.rot.od.sap.biz](http://clts.rot.od.sap.biz) ‘/bin/sh -c ‘"’"’( umask 77 && mkdir -p “`echo ~/.ansible/tmp/ansible-tmp-1499884456.62-175962548351199`” && echo ansible-tmp-1499884456.62-175962548351199=“`echo ~/.ansible/tmp/ansible-tmp-1499884456.62-175962548351199`” ) && sleep 0’“'”‘’ (1, ‘’, ‘“/bin/sh” isn't allowed to be executed.\n’) clts | UNREACHABLE! =\> { “changed”: false, “msg”: “Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the remote directory. Consider changing the remote temp path in ansible.cfg to a path rooted in "/tmp". Failed command was: ( umask 77 && mkdir -p "`echo ~/.ansible/tmp/ansible-tmp-1499884456.62-175962548351199`" && echo ansible-tmp-1499884456.62-175962548351199="`echo ~/.ansible/tmp/ansible-tmp-1499884456.62-175962548351199`" ), exited with result 1”, “unreachable”: true } root@WDFN34201151A:/mnt/c/Users/user/Documents/Projects/Ansible\_Playbooks/Automation# ---
**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\ **Post date:** [July 12, 2017, 7:43pm UTC](https://forum.ansible.com/t/bin-sh-isn-t-allowed-to-be-executed/24960/4 "2017-07-12T19:43:50Z")
I think I’ve figured out what is causing the issue. I don’t know what to do solve the issue. Sudosh has been configured to only allow certain commands via remote shell. On a test system running more or less the same setup I can configure sudosh (/etc/sudosh.conf) to allow all commands. I don’t want to do that on this machine as it would undermine security. I’d rather figure out what Ansible needs and request that. Any ideas what commands would need to be allowed to let Ansible do its thing? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [July 12, 2017, 8:29pm UTC](https://forum.ansible.com/t/bin-sh-isn-t-allowed-to-be-executed/24960/5 "2017-07-12T20:29:48Z")
Ansible runs arbitrary code/commands (modules) so when using privilege escalation it does not support restrictive setups, see docs [http://docs.ansible.com/ansible/become.html](http://docs.ansible.com/ansible/become.html)