# Copy file with sudo; sudo /bin/sh not allowed **URL:** \ **Category:** Ansible Project\ **Created:** [September 28, 2018, 4:36pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675 "2018-09-28T16:36:32Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 4:36pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/1 "2018-09-28T16:36:32Z")
Hi, I am sorry for the newbie question, I ve just started looking into Ansible but I did not find any info in the docs or anywhere else that could help me find a resolution. I have a bunch of hosts on which I have sudo access. **\>sudo whoami** **root** But I do not have permission to run **\> sudo /bin/sh -c echo “Hello!”** **Sorry, user some-user is not allowed to execute ‘/bin/sh -c echo Hello world’ as root on blabahost.** This is blocking me from executing a simple playbook which copies files under **/etc/yum.repos.d** The playbook like this: ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [September 28, 2018, 4:42pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/2 "2018-09-28T16:42:29Z")
You need unrestricted sudo [https://docs.ansible.com/ansible/latest/user\_guide/become.html#can-t-limit-escalation-to-certain-commands](https://docs.ansible.com/ansible/latest/user_guide/become.html#can-t-limit-escalation-to-certain-commands) ---
**Author:** ![Karthik\_Chandrasheka](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@Karthik\_Chandrasheka](https://forum.ansible.com/u/Karthik_Chandrasheka)\ **Post date:** [September 28, 2018, 5:08pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/3 "2018-09-28T17:08:28Z")
What is the username you are trying to connect as ? ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 5:25pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/4 "2018-09-28T17:25:08Z")
Unfortunately this is not an option for me 😕 Thanks, Nicola ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [September 28, 2018, 5:26pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/5 "2018-09-28T17:26:12Z")
You might want to look at using ansible-pull from cron then. ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 5:28pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/6 "2018-09-28T17:28:43Z")
I am running the playbook without specifying an user: **ansible-playbook --ask-become-pass -vvv test-playbook** Running the command with -u flag does not change the error: **ansible-playbook -u napicella --ask-become-pass -vvv test-playbook** where **napicella** is an user on both the local machine and the remote one ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 5:32pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/7 "2018-09-28T17:32:00Z")
Interesting. Thanks Brian ---
**Author:** ![Karthik\_Chandrasheka](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@Karthik\_Chandrasheka](https://forum.ansible.com/u/Karthik_Chandrasheka)\ **Post date:** [September 28, 2018, 5:32pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/8 "2018-09-28T17:32:24Z")
Well, is that user been given sudo rights on remote machine if so, Could you check if you are able to login as that user and execute the same task manually without ansible. ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 5:39pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/9 "2018-09-28T17:39:24Z")
It does have sudo access, but it is restricted, namely it cannot use exec **/bin/sh.** So if I do: **napicella@localhost \> ssh blablahost** **napicella@blalahost\> sudo cp /tmp/a \> /etc/yum.repos.d/a** This works as expected, what it does not work is: **napicella@blalahost\> sudo /bin/bash -c ‘cp /tmp/a \> /etc/yum.repos.d/a’** **Sorry user napicella is not allowed to execute /bin/bash …** which appears to be exactly what Ansible does when the **become** property is set in the playbook task ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 5:43pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/10 "2018-09-28T17:43:29Z")
As @BrianCoca mentioned, I am afraid I need unrestricted sudo access to run Ansible. From the docs is kinda hard to understand that: [https://docs.ansible.com/ansible/latest/user\_guide/become.html#can-t-limit-escalation-to-certain-commands](https://docs.ansible.com/ansible/latest/user_guide/become.html#can-t-limit-escalation-to-certain-commands) It might be just me, but I do no quite get it ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [September 28, 2018, 5:52pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/11 "2018-09-28T17:52:18Z")
Generally speaking, ansible does not run many shell commands to perform these actions. Instead many modules rely on executing python code that will achieve your goal. As such, restricting sudo to something like `cp` can’t work for the `copy` module. Instead we run something more like `sudo /bin/sh -c '/usr/bin/python /path/to/some/temp/python/script.py'` You _can_ achieve results similar to what you want, by severely restricting yourself to only using the raw/command/shell modules like: - command: sudo cp foo bar It isn’t really recommended to do this, as it doesn’t support password prompting, and you lose a lot of additional functionality provided by the other ansible modules. Also, let me pose this question, how is allowing `sudo cp` more secure? I would assume most configurations would allow: sudo cp give\_me\_access\_sudoers /etc/sudoers I’d recommend talking to the person responsible for your sudoers configuration. ---
**Author:** ![Karthik\_Chandrasheka](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@Karthik\_Chandrasheka](https://forum.ansible.com/u/Karthik_Chandrasheka)\ **Post date:** [September 28, 2018, 5:56pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/12 "2018-09-28T17:56:22Z")
Can you try to change your playbook a little bit. Just below hosts mention: remote\_user: \< username \> remove become\_method option ( I assume you are using ansible version =\> 1.9 ) I don’t think ansible in the backed uses below syntax for any task executions as root: **sudo /bin/bash -c ‘cp /tmp/a \> /etc/yum.repos.d/a’** ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 6:25pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/13 "2018-09-28T18:25:23Z")
Hi, thanks for the answer. I agree with u, that using only command is a severe restriction and it kinda miss the point of using Ansible. As for the question about restricting access, well, great question. It is more secure, because the sudoers file is generated and kept in sync by a daemon running on the host. By changing the file, you get unrestricted access for a short time, after which the daemon will override the content. Stopping the daemon basically cuts the host off from the system. This is my understanding of how things work, but I am not a system engineer and definitely not an expert. ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 6:26pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/14 "2018-09-28T18:26:25Z")
I tried, same result. Thanks! ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 6:44pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/15 "2018-09-28T18:44:12Z")
…but I am not sure why restricting shell from sudo is a security measure. Gotta investigate that. ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 7:02pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/16 "2018-09-28T19:02:53Z")
I think I got it. Not restricting shell allows for the user to run **sudo** **/bin/sh** first and then run whatever the user wants, including **sudo su** ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [September 28, 2018, 7:20pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/17 "2018-09-28T19:20:24Z")
That is not really a security restraint as `sudo -u` is equivalent to `sudo su`, agreed that /bin/shell will give you 'unrestricted commands', but that is normally the requirement if you are going to manage a server. 41 ---
**Author:** ![Nicola\_Apicella](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Nicola\_Apicella](https://forum.ansible.com/u/Nicola_Apicella)\ **Post date:** [September 28, 2018, 7:32pm UTC](https://forum.ansible.com/t/copy-file-with-sudo-sudo-bin-sh-not-allowed/28675/18 "2018-09-28T19:32:27Z")
Right. Thanks for taking the time. Much appreciated!