Deleting a user; still being used

Archives Ansible Project
1

Hello,

I am instantiating an EC2 instance from a community AMI in the Marketplace. The AMI comes pre-baked with a default user (ec2-user).

I have a role in my Ansible repository which is applied to all machines, called common. Inside this role, I have a few tasks which create a new user (ansible), configure an SSH key for it, and sort out an entry in /etc/sudoers. These tasks are tagged as ‘firstrun’.

The first time I run Ansible, I connect with the ec2-user account remotely using:

ansible-playbook -i hosts site.yml --tags firstrun

This means that I only run those tasks tagged as firstrun, which makes the initial run quick. After this has completed successfully, I run:

ansible-playbook -u ansible -i hosts site.yml --skip-tags firstrun

This time, I’m skipping the tasks I’ve already run, and am also running Ansible as the ansible user on the instance. This adds a load of other plays to the machine, which works fine.

I have a slight problem, however. When I invoke ansible-playbook for the second time, I expect it to run a task using the user module to delete the ec2-user account:

name: remove ec2-user

become: yes

become_user: root

user: name=ec2-user state=absent remove=yes force=yes

Instead of this working correctly, I get this message:

msg: userdel: user ec2-user is currently used by process 1918
userdel: cannot open /etc/subuid

I don’t see why (maybe I’m snowblind from having looked at this a bit too long!) the ec2-user still being used, given that by the time Ansible gets to this task, the connection for the first run should have timed out, or the socket should have closed.

Does anyone have any ideas? It may just be that I can’t see the wood from the trees!

2

I add this problem, I did this:

  • name: Remove old “pi” account
    hosts: qemu
    become: yes
    become_method: sudo
    gather_facts: false
    tasks:
  • name : Kill all “pi” user’s processes and remove the account
    shell : “killall -KILL -u pi ; userdel -fr pi”

Didn’t work, “…cannot open /etc/subuid”

- name: Remove pi account

user: name=pi state=absent force=yes remove=yes

not very clean, but works

Bruno

3

I had not add !! sorry

4

So I am not the only one that has this problem on the raspberry pi :wink: 1.

I am still confused on why I have this problem only on the raspberry pi but
killing the process works great. Thanks!
I still would prefer to set ControlMaster=no just for the one playbook that
uses the default user. But unfortunately there is no ssh_args playbook attribute.

Regards
Davide