# Does Ansible have to run as root? sudo and --become-user **URL:** \ **Category:** Ansible Project\ **Created:** [September 13, 2016, 4:41pm UTC](https://forum.ansible.com/t/does-ansible-have-to-run-as-root-sudo-and-become-user/22536 "2016-09-13T16:41:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Mike\_Schlottman](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@Mike\_Schlottman](https://forum.ansible.com/u/Mike_Schlottman)\ **Post date:** [September 13, 2016, 4:41pm UTC](https://forum.ansible.com/t/does-ansible-have-to-run-as-root-sudo-and-become-user/22536/1 "2016-09-13T16:41:06Z")
I have just started looking into Ansible and have built a server on Centos 7. I generally don’t run anything as root so I created an ansible account and group and chown -R ansible:ansible /etc/ansible. I assumed that this would be OK, but as I start experimenting with commands, it does not seem to use sudo the way I had expected. As expected this fails because the ansible user does not have access to read /etc/shadow. -sh-4.2$ ansible localhost -a ‘/bin/cat /etc/shadow’ localhost | FAILED | rc=1 \>\> /bin/cat: /etc/shadow: Permission denied When I try -b and --become-user root, I get this. -sh-4.2$ ansible localhost -a ‘/bin/cat /etc/shadow’ -b --become-user root localhost | FAILED | rc=0 \>\> MODULE FAILURE /var/log/secure shows the following. Sep 13 11:39:43 ansible sudo: servacct\_ansible : TTY=pts/3 ; PWD=/home/servacct\_ansible ; USER=root ; COMMAND=/bin/sh -c echo BECOME-SUCCESS-jjadcdyvpoluzchkhvkophnzqvhoxrcz; LANG=en\_US.UTF-8 LC\_ALL=en\_US.UTF-8 LC\_MESSAGES=en\_US.UTF-8 /usr/bin/python /home/servacct\_ansible/.ansible/tmp/ansible-tmp-1473784783.91-193737108086693/command; rm -rf “/home/servacct\_ansible/.ansible/tmp/ansible-tmp-1473784783.91-193737108086693/” \> /dev/null 2\>& Am I using --become-user incorrectly? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [September 13, 2016, 5:24pm UTC](https://forum.ansible.com/t/does-ansible-have-to-run-as-root-sudo-and-become-user/22536/2 "2016-09-13T17:24:13Z")
Using --become-user only sets the user, it does not force using become, you need --become to do that. This is because you can set using privilege escalation in the inventory also and this lets you mix/match settings. ---
**Author:** ![Mike\_Schlottman](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@Mike\_Schlottman](https://forum.ansible.com/u/Mike_Schlottman)\ **Post date:** [September 13, 2016, 5:39pm UTC](https://forum.ansible.com/t/does-ansible-have-to-run-as-root-sudo-and-become-user/22536/3 "2016-09-13T17:39:24Z")
I thought the -b and --become do the same thing. If I run this command as root, it works. If I run it as a non-root user, I get the MODULE FAILURE error. ansible localhost -a ‘/bin/cat /etc/shadow’ --become --become-user root ---
**Author:** ![Mike\_Schlottman](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@Mike\_Schlottman](https://forum.ansible.com/u/Mike_Schlottman)\ **Post date:** [September 13, 2016, 6:31pm UTC](https://forum.ansible.com/t/does-ansible-have-to-run-as-root-sudo-and-become-user/22536/4 "2016-09-13T18:31:50Z")
I found the problem by using the -m service instead of -a. The root user does not have permission to read the ansible tmp files because the home directory is an nfs mount. I’ll move the ansible user out of the NFS directory and that should fix things. -sh-4.2$ ansible localhost -m service -a “name=rsyslog state=restarted” --become --become-user root localhost | FAILED! =\> { “changed”: false, “failed”: true, “module\_stderr”: “”, “module\_stdout”: “/usr/bin/python: can’t open file ‘/home/servacct\_ansible/.ansible/tmp/ansible-tmp-1473791346.09-103884258170467/service’: [Errno 13] Permission denied\r\n”, “msg”: “MODULE FAILURE”, “parsed”: false } ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [September 13, 2016, 7:00pm UTC](https://forum.ansible.com/t/does-ansible-have-to-run-as-root-sudo-and-become-user/22536/5 "2016-09-13T19:00:20Z")
> I have just started looking into Ansible and have built a server on Centos > 7. I generally don't run anything as root so I created an ansible account > and group and chown -R ansible:ansible /etc/ansible. > > I assumed that this would be OK, but as I start experimenting with > commands, it does not seem to use sudo the way I had expected. It's perfectly OK to create a user, Ansible work great with sudo. > As expected this fails because the ansible user does not have access to > read /etc/shadow. > > -sh-4.2$ ansible localhost -a '/bin/cat /etc/shadow' > localhost | FAILED | rc=1 \>\> > /bin/cat: /etc/shadow: Permission denied > > When I try -b and --become-user root, I get this. > -sh-4.2$ ansible localhost -a '/bin/cat /etc/shadow' -b --become-user root > localhost | FAILED | rc=0 \>\> > MODULE FAILURE [snip] > Am I using --become-user incorrectly? I would not say so. What you are missng is the sudo password. The become user is default root, so you do not need to specify that. And you are using -b for become. But you must provide the sudo password if you don't have NOPASSWORD in sudoers. So this should work for you: ansible localhost -a 'cat /etc/shadow' -b --ask-sudo-pass