# Headless Ansible

**URL:** <https://forum.ansible.com/t/headless-ansible/1533>\
**Category:** Get Help\
**Tags:** ssh, ansible-core\
**Created:** [October 8, 2023, 9:38pm UTC](https://forum.ansible.com/t/headless-ansible/1533 "2023-10-08T21:38:23Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [October 18, 2023, 2:24am UTC](https://forum.ansible.com/t/headless-ansible/1533/13 "2023-10-18T02:24:29Z")

</div>

Sorry, @charlespick . My ancient reptilian brain remembers when people thought this was acceptable. Modern OSs don’t honor the suid bit on scripts any more, and for [good reasons](https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts). I’m embarrassed to have brought it up.

There are better ways to get the effect you want, though. Below is a simple script I called `id-a.sh`:

```sh
#!/usr/bin/bash

cmd="$(realpath "$0")"
ansibleid="ansible-unleashed"

printf "PID $$ starting $cmd as '%s' in '%s'\n" "$(id -un)" "$(/bin/pwd)"
if ["$(id -un)" != "$ansibleid"] ; then
  sudo runuser -l "$ansibleid" "$cmd"
  rc=$?
  printf "PID $$ ending run of $cmd as '%s' in '%s'\n" "$(id -un)" "$(/bin/pwd)"
  exit $rc
fi

printf "PID $$ running $cmd as '%s' in '%s'\n" "$(id -un)" "$(/bin/pwd)"
# Put your ansible-playbook command here.
# And comment out all the other stuff; it's just to prove
# the technique works anyway.
printf "whoami: %s\n" "$(whoami)"
printf "id -a: %s\n" "$(id -a)"
touch /tmp/id-a.test.$$
printf "touch test: %s\n" "$(ls -l /tmp/id-a.test.$$)"
rm -f /tmp/id-a.test.$$

```

And here’s the output of a run:

```txt
PID 1234130 starting /home/utoddl/ansible/id-a.sh as 'utoddl' in '/home/utoddl/ansible'
PID 1234139 starting /home/utoddl/ansible/id-a.sh as 'ansible-unleashed' in '/home/ansible-unleashed'
PID 1234139 running /home/utoddl/ansible/id-a.sh as 'ansible-unleashed' in '/home/ansible-unleashed'
whoami: ansible-unleashed
id -a: uid=123454321(ansible-unleashed) gid=123454321(ansible-unleashed) groups=123454321(ansible-unleashed) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
touch test: -rw-r--r--. 1 ansible-unleashed ansible-unleashed 0 Oct 17 21:54 /tmp/id-a.test.1234139
PID 1234130 ending run of /home/utoddl/ansible/id-a.sh as 'utoddl' in '/home/utoddl/ansible'

```

This script checks to see if it’s running as the user `ansible-unleashed`, and if it isn’t, it re-runs itself with `sudo runuser -l ansible-unleashed /home/utoddl/ansible/id-a.sh` which runs the command under the `ansible-unleashed` user with a login shell.

Your problem then is to setup password-less sudo for the `nut` user for this one command, which is conveniently described [here](http://forum.ansible.com/t/community-general-shutdown-interactive-authentication-required/1728/4) — if you squint a little and substitute a few strings.

This may seem like a lot of fluff to replace a single suid bit, but it avoids (1) some bad practices that (2) no longer work anyway and (3) can be managed without surprises on modern systems.

---

_[View the full topic](https://forum.ansible.com/t/headless-ansible/1533)._