# Help for community.general.sudoers collection **URL:** \ **Category:** Get Help\ **Created:** [April 10, 2024, 2:09pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863 "2024-04-10T14:09:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![souovan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/souovan/32/1637_2.png) [@souovan](https://forum.ansible.com/u/souovan)\ **Post date:** [April 10, 2024, 2:09pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863/1 "2024-04-10T14:09:59Z")
Hi guys i have a task to use community.general.sudoers collection to do some configurations to sudoers file, but based on the collection documentation i didnt see a way of doing that, anyone has already used this collection for this purpose ? The task i need to do is set some configs like the list below to a user or group, but following the collection doc i didnt find a way of doing this, seems like the collection only allow to explicitly set which commands user or group can have access by pointing to its binarie - !PASSWD - !SU - NOPASSWD: ALL ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [April 10, 2024, 2:35pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863/2 "2024-04-10T14:35:33Z")
I don’t see any reason why you can’t use the module you found? [community.general.sudoers module – Manage sudoers files — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/community/general/sudoers_module.html) ```yaml - name: Restrict sudoer's access community.general.sudoers: name: my_custom_rule user: username # group: group_name # mutually exclusive with user: host: ALL nopassword: true commands: - '!PASSWD' - '!SU' ``` creates `/etc/sudoers.d/my_custom_rule` with ```bash username ALL=NOPASSWD: !PASSWD, !SU ``` Does this not acheive what you’re after? The only thing of note I see is that this doesn’t let you create multiple lines/rules in the same file. Alternatively, you can use the copy, template, or lineinfile modules and use the `validate: /usr/sbin/visudo -cf %s` parameter to ensure the changes you make won’t break sudoers. ---
**Author:** ![souovan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/souovan/32/1637_2.png) [@souovan](https://forum.ansible.com/u/souovan)\ **Post date:** [April 10, 2024, 4:37pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863/3 "2024-04-10T16:37:04Z")
Thank you for your help, i had a typo on: - !PASSWD - !SU now i did as you purpose using single quotes: - ‘!PASSWD’ - ‘!SU’ Now what i’m not understanding is that i already had the collection installed: ```auto [van@aap sudoers]$ ansible-galaxy collection list # /usr/share/ansible/collections/ansible_collections Collection Version ----------------- ------- community.general 4.8.9 # /home/van/.ansible/collections/ansible_collections Collection Version ------------------------ ------- community.general 5.8.0 redhat.rhel_system_roles 1.23.0 ``` had alread pointed to it on `ansible.cfg` ```auto [van@aap sudoers]$ cat ansible.cfg [defaults] inventory = hosts roles_path = /usr/share/ansible/collections/ansible_collections [privilege_escalation] become_method = sudo ``` but i’m getting error to use it ```auto [van@aap sudoers]$ ansible-playbook tasks/main.yaml --user root ERROR! 'community.general.sudoers' is not a valid attribute for a Play The error appears to be in '/home/van/roles/sudoers/tasks/main.yaml': line 3, column 7, but may be elsewhere in the file depending on the exact syntax problem. The offending line appears to be: - name: Configure sudoers to enable group to execute commands ^ here ``` what iam doing wrong ? ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [April 10, 2024, 5:02pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863/4 "2024-04-10T17:02:28Z")
You can’t execute a tasks file as a playbook. If it’s part of a role, you need to call the role from a playbook, otherwise you can use `include_tasks:` to call it. (though technically you can include\_tasks directly to a task file in a role if you can path to it) ---
**Author:** ![souovan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/souovan/32/1637_2.png) [@souovan](https://forum.ansible.com/u/souovan)\ **Post date:** [April 10, 2024, 5:42pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863/5 "2024-04-10T17:42:02Z")
But my playbook is following your example as follows: ```auto --- - name: Configure sudoers to enable group to execute commands community.general.sudoers: become: true group: teste commands: - ALL - '!PASSWD' - '!SU' - name: Configure sudoers to enable users to execute commands community.general.sudoers: become: true user: teste1 nopassword: true commands: - ALL - name: Insert conf sudoers ansible.builtin.lineinfile: become: true path: /etc/sudoers line: "{{ item }}" with_items: - "###Configurações de acesso para usuários do AD###" - "cmd_alias PASSWD=/usr/bin/passwd" - "cmd_alias SU=/bin/su" ``` ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [April 10, 2024, 5:47pm UTC](https://forum.ansible.com/t/help-for-community-general-sudoers-collection/4863/6 "2024-04-10T17:47:01Z")
Your snippet is just a tasks file, it’s missing play keys: ```yaml --- - name: Configure sudo hosts: all tasks: - name: Configure sudoers to enable group to execute commands community.general.sudoers: become: true group: teste commands: - ALL - '!PASSWD' - '!SU' - name: Configure sudoers to enable users to execute commands community.general.sudoers: become: true user: teste1 nopassword: true commands: - ALL - name: Insert conf sudoers ansible.builtin.lineinfile: become: true path: /etc/sudoers line: "{{ item }}" validate: /usr/sbin/visudo -cf %s with_items: - "###Configurações de acesso para usuários do AD###" - "cmd_alias PASSWD=/usr/bin/passwd" - "cmd_alias SU=/bin/su" ``` Edit: You also didn’t validate your sudo changes with lineinfile.