# How does Ansible know what account to use for the SSH connection and sudo

**URL:** <https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341>\
**Category:** Ansible Project\
**Created:** [January 21, 2015, 4:25pm UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341 "2015-01-21T16:25:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 21, 2015, 4:25pm UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/1 "2015-01-21T16:25:06Z")

</div>

I do not understand how this example works for user **foo**

If I have not stated the user account to use for the ssh connection within the command line using: **ansible\_ssh\_user=foo**  
or the Ansible host file: **/etc/ansible/hosts**

Is the current user account used as the ssh connection to a remote server if not specified on the command line or within the file\*\*: /etc/ansible/hosts\*\* ?

If so, does the logic for which user account to use for the ssh connection go like this:

Use the current user account, unless specified in the command line using command: **ansible\_ssh\_user=foo**  
and if not specified in the **/etc/ansible/hosts** file as: **ansible\_ssh\_user=foo**

Ansible Local Server Remote server  
**local-01**  **remote-01**

* * *

Local User foo → ssh → Remote user foo

So in this example:  
(1) Local user running **/usr/bin/ansible** is **foo**  
(2) Remote user is an account on the remote box **remote-01** which is also named foo  
(3) sudoing will sudo to the remote account foo. Which as you say is a no-op.

**Server local-01**  
[root@local-01 /]# **grep sudo\_user /etc/ansible/ansible.cfg**  
sudo\_user = root  
[root@local-01 /]# **cat /etc/ansible/hosts**  
[servers]  
remote-01  
[root@local-01 /]#

Ansible command  
[root@local-01 ~]# **su - foo**  
[foo@local-01 ~]$ **ssh foo@remote-01 whoami**  
foo  
[foo@local-01 ~]$ **ansible remote-01 -m command -a “whoami”**  
**remote-01 | success | rc=0 \>\>**  
**foo**  
[foo@local-01 ~]$

Question  
How does the above Ansible command work if I have not specified the user account for the SSH connection or the local user account either within  
the command line, **/etc/ansible/ansible.cfg** or within the file **/etc/ansible/hosts**?

Is this not the function of the parameters **ansible\_ssh\_user** and **ansible\_sudo\_user**?

Should I not need to specify this: **ansible\_ssh\_user=foo**?  
Even if I do not need this: **ansible\_sudo\_user=foo**?

---

<div class="post-metadata">

**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\
**Post date:** [January 21, 2015, 5:24pm UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/2 "2015-01-21T17:24:46Z")

</div>

> I do not understand how this example works for user foo
> 
> If I have not stated the user account to use for the ssh connection within  
> the command line using: ansible\_ssh\_user=foo  
> or the Ansible host file: /etc/ansible/hosts
> 
> Is the current user account used as the ssh connection to a remote server if  
> not specified on the command line or within the file: /etc/ansible/hosts ?

Correct.

> If so, does the logic for which user account to use for the ssh connection  
> go like this:
> 
> Use the current user account, unless specified in the command line using  
> command: ansible\_ssh\_user=foo

Via the command line:  
\* for /usr/bin/ansible use: -u foo  
&nbsp;&nbsp;/usr/bin/ansible rhel7-test -u ansibletest1 -a whoami  
\* for /usr/bin/ansible-playbook you can use -u foo if nothing else is  
setting the user (not in /etc/ansible/hosts or the playbook). If you  
really want to override what's specified in hosts or the playbook use  
-e ansible\_ssh\_user=foo:  
&nbsp;&nbsp;ansible-playbook test.yml -v -e 'ansible\_ssh\_user=ansibletest1'

> and if not specified in the /etc/ansible/hosts file as:  
> ansible\_ssh\_user=foo
> 
> Ansible Local Server Remote server  
> local-01 remote-01  
> --------------------------- --------------------  
> Local User foo --\> ssh --\> Remote user foo
> 
> So in this example:  
> (1) Local user running /usr/bin/ansible is foo  
> (2) Remote user is an account on the remote box remote-01 which is also  
> named foo  
> (3) sudoing will sudo to the remote account foo. Which as you say is a  
> no-op.

#3 is only true if you've specified that foo is the sudo\_user  
somewhere (for instance in ansible.cfg)  
Otherwise you'll be sudo'ing to root.

> Server local-01  
> [root@local-01 /]# grep sudo\_user /etc/ansible/ansible.cfg  
> sudo\_user = root  
> [root@local-01 /]# cat /etc/ansible/hosts  
> [servers]  
> remote-01  
> [root@local-01 /]#
> 
> Ansible command  
> [root@local-01 ~]# su - foo  
> [foo@local-01 ~]$ ssh foo@remote-01 whoami  
> foo  
> [foo@local-01 ~]$ ansible remote-01 -m command -a "whoami"  
> remote-01 | success | rc=0 \>\>  
> foo  
> [foo@local-01 ~]$

\<nod\> This is all correct. I see that you pointed out that sudo\_user  
= root in ansible.cfg. So just in case you're wondering, ansible does  
not sudo unless you tell it to. That would look something like this:

[foo@local-01 ~]$ ansible remote-01 -m command -a "whoami" --sudo -K  
sudo password:  
remote-01 | success | rc=0 \>\>  
root

> Question  
> How does the above Ansible command work if I have not specified the user  
> account for the SSH connection or the local user account either within  
> the command line, /etc/ansible/ansible.cfg or within the file  
> /etc/ansible/hosts ?

The default for ansible (and for ssh) is to use the username that you  
are logged in locally as.

> Is this not the function of the parameters ansible\_ssh\_user and  
> ansible\_sudo\_user ?

ansible\_ssh\_user (in /etc/ansible/hosts or another inventory file)  
overrides that, yes.

ansible\_sudo\_user specifies which user to sudo to once you've ssh'd  
into the remote box.

> Should I not need to specify this: ansible\_ssh\_user=foo ?  
> Even if I do not need this: ansible\_sudo\_user=foo ?

In most people's environments they have the same username on all of  
their boxes. So those people don't need to set ansible\_ssh\_user. If  
you are using different usernames on the local and remote box then you  
do need to set ansible\_ssh\_user so that ansible knows which account it  
needs to ssh into on the remote machine.

-Toshio

---

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 21, 2015, 7:28pm UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/3 "2015-01-21T19:28:17Z")

</div>

Got it.

Thank you tkuratomi for the very informative answer.  
Cheers

---

<div class="post-metadata">

**Author:** ![Tom\_Bamford](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@Tom\_Bamford](https://forum.ansible.com/u/Tom_Bamford)\
**Post date:** [January 22, 2015, 8:49am UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/4 "2015-01-22T08:49:15Z")

</div>

Note that if you are using ssh transport (not sure about Paramiko), and you have a matching host in ssh\_config with a User line, that will be used.

So given that ~you/.ssh/config contains

```auto
Host myhost
User root

```

and you invoke the following as `you`…

```auto
ansible myhost -a whoami

```

…Ansible will connect as root

​

---

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 22, 2015, 9:51am UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/5 "2015-01-22T09:51:37Z")

</div>

Hi this bit is not correct: “…Ansible will connect as root”

That did confuse me as there does not seem to be any documentation for using different user accounts and how they interact with Ansible.

In my example above. The user account that Ansible uses to connect as is the **foo** user.

My example does the following:  
Running the Ansible command as user **foo** on the local server **local-01**  
User **foo** on the local Ansible server **local-01** , connects as user **foo** using SSH to the remote server **remote-01** and reports back that it is logged in as user **foo**

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [January 22, 2015, 3:21pm UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/6 "2015-01-22T15:21:04Z")

</div>

ansible just calls ssh and sudo, it works the same as those tools do  
because it uses those tools.

if you run ssh as 'foo' on the local server and do not specify a  
remote user to connect as, ssh will use foo as the login user on the  
remote machine. Ansible does exactly the same.

---

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 24, 2015, 1:15pm UTC](https://forum.ansible.com/t/how-does-ansible-know-what-account-to-use-for-the-ssh-connection-and-sudo/17341/7 "2015-01-24T13:15:14Z")

</div>

Thank you Brian. Question resolved.