# Disable become sudo "-n" flag?

**URL:** <https://forum.ansible.com/t/disable-become-sudo-n-flag/20284>\
**Category:** Ansible Project\
**Created:** [January 20, 2016, 12:01am UTC](https://forum.ansible.com/t/disable-become-sudo-n-flag/20284 "2016-01-20T00:01:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josef\_Fortier](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@Josef\_Fortier](https://forum.ansible.com/u/Josef_Fortier)\
**Post date:** [January 20, 2016, 12:01am UTC](https://forum.ansible.com/t/disable-become-sudo-n-flag/20284/1 "2016-01-20T00:01:45Z")

</div>

I’ve a few old server in maintenance with older versions of sudo.  
Since upgrading to ansible 2.0 (and 2.01) these servers are erroring out on sudo/become calls with:

sudo: illegal option `-n’

Checking these servers, I do see that the sudo versions do not support “-n”.

Is there a workaround for this?

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [January 20, 2016, 12:31am UTC](https://forum.ansible.com/t/disable-become-sudo-n-flag/20284/2 "2016-01-20T00:31:25Z")

</div>

You can set the sudo flags in ansible.cfg, env var or in  
ansible\_sudo\_flags inventory variable. The default is "-H -s -n". I  
recommend you keep -H and -s.

---

<div class="post-metadata">

**Author:** ![Josef\_Fortier](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@Josef\_Fortier](https://forum.ansible.com/u/Josef_Fortier)\
**Post date:** [January 20, 2016, 7:12pm UTC](https://forum.ansible.com/t/disable-become-sudo-n-flag/20284/3 "2016-01-20T19:12:41Z")

</div>

Thanks!

In my situations, an inventory variable makes the most sense.  
For others reference, here is the needed synax in inventory.

[oes10managed:vars]  
ansible\_sudo\_flags=‘-H’

Note that the case is lowercase (unlike the environmental variable).

This just “grandfathers in” the (newly) broken sudo clients without effecting other clients.

I could not get the " -s " flag to work. I received errors like:  
/bin/sh: /bin/sh: cannot execute binary file

Which I take to be further changes in sudo syntax.

That said, since I’m running the commands, I’m reasonably happy here that no problematic shell will be triggered.  
As near as I can tell, this is most likely to avoid malicious playbooks.