# Deleting a user; still being used

**URL:** <https://forum.ansible.com/t/deleting-a-user-still-being-used/19869>\
**Category:** Ansible Project\
**Created:** [November 26, 2015, 9:05pm UTC](https://forum.ansible.com/t/deleting-a-user-still-being-used/19869 "2015-11-26T21:05:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Langhorn1](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@Andrew\_Langhorn1](https://forum.ansible.com/u/Andrew_Langhorn1)\
**Post date:** [November 26, 2015, 9:05pm UTC](https://forum.ansible.com/t/deleting-a-user-still-being-used/19869/1 "2015-11-26T21:05:53Z")

</div>

Hello,

I am instantiating an EC2 instance from a community AMI in the Marketplace. The AMI comes pre-baked with a default user (ec2-user).

I have a role in my Ansible repository which is applied to all machines, called common. Inside this role, I have a few tasks which create a new user (`ansible`), configure an SSH key for it, and sort out an entry in /etc/sudoers. These tasks are tagged as ‘firstrun’.

The first time I run Ansible, I connect with the ec2-user account remotely using:

> ansible-playbook -i hosts site.yml --tags firstrun

This means that I only run those tasks tagged as firstrun, which makes the initial run quick. After this has completed successfully, I run:

> ansible-playbook -u ansible -i hosts site.yml --skip-tags firstrun

This time, I’m skipping the tasks I’ve already run, and am also running Ansible as the `ansible` user on the instance. This adds a load of other plays to the machine, which works fine.

I have a slight problem, however. When I invoke `ansible-playbook` for the second time, I expect it to run a task using the user module to delete the ec2-user account:

> name: remove ec2-user

> become: yes

> become\_user: root

> user: name=ec2-user state=absent remove=yes force=yes

Instead of this working correctly, I get this message:

> msg: userdel: user ec2-user is currently used by process 1918  
> userdel: cannot open /etc/subuid

I don’t see why (maybe I’m snowblind from having looked at this a bit too long!) the ec2-user still being used, given that by the time Ansible gets to this task, the connection for the first run should have timed out, or the socket should have closed.

Does anyone have any ideas? It may just be that I can’t see the wood from the trees!

---

<div class="post-metadata">

**Author:** ![Bruno\_Vernay](https://avatars.discourse-cdn.com/v4/letter/b/97f17d/32.png) [@Bruno\_Vernay](https://forum.ansible.com/u/Bruno_Vernay)\
**Post date:** [February 1, 2016, 12:40pm UTC](https://forum.ansible.com/t/deleting-a-user-still-being-used/19869/2 "2016-02-01T12:40:16Z")

</div>

I add this problem, I did this:

- name: Remove old “pi” account  
hosts: qemu  
become: yes  
become\_method: sudo  
gather\_facts: false  
tasks:
- name : Kill all “pi” user’s processes and remove the account  
shell : “killall -KILL -u pi ; userdel -fr pi”

# Didn’t work, “…cannot open /etc/subuid”

# - name: Remove pi account

# user: name=pi state=absent force=yes remove=yes

not very clean, but works

Bruno

---

<div class="post-metadata">

**Author:** ![Bruno\_Vernay](https://avatars.discourse-cdn.com/v4/letter/b/97f17d/32.png) [@Bruno\_Vernay](https://forum.ansible.com/u/Bruno_Vernay)\
**Post date:** [February 1, 2016, 2:02pm UTC](https://forum.ansible.com/t/deleting-a-user-still-being-used/19869/3 "2016-02-01T14:02:29Z")

</div>

I _had_ not _add_ !! sorry

---

<div class="post-metadata">

**Author:** ![Davide](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@Davide](https://forum.ansible.com/u/Davide)\
**Post date:** [February 9, 2018, 11:16pm UTC](https://forum.ansible.com/t/deleting-a-user-still-being-used/19869/4 "2018-02-09T23:16:34Z")

</div>

So I am not the only one that has this problem on the raspberry pi 😉 [1](https://groups.google.com/forum/#!topic/ansible-project/pMMINWCyALE).

I am still confused on why I have this problem only on the raspberry pi but  
killing the process works great. Thanks!  
I still would prefer to set ControlMaster=no just for the one playbook that  
uses the default user. But unfortunately there is no ssh\_args playbook attribute.

Regards  
Davide
