# How should I use sudo\_user and sudo together when logging in as a non-root user and switching to another user?

**URL:** <https://forum.ansible.com/t/how-should-i-use-sudo-user-and-sudo-together-when-logging-in-as-a-non-root-user-and-switching-to-another-user/17474>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [February 9, 2015, 3:24pm UTC](https://forum.ansible.com/t/how-should-i-use-sudo-user-and-sudo-together-when-logging-in-as-a-non-root-user-and-switching-to-another-user/17474 "2015-02-09T15:24:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Adams](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Chris\_Adams](https://forum.ansible.com/u/Chris_Adams)\
**Post date:** [February 9, 2015, 3:24pm UTC](https://forum.ansible.com/t/how-should-i-use-sudo-user-and-sudo-together-when-logging-in-as-a-non-root-user-and-switching-to-another-user/17474/1 "2015-02-09T15:24:16Z")

</div>

Hi there,

Can someone give me some pointers as to why an ansible role using sudo\_user below would complain about _missing sudo passwords, when I’m able to:_

1. _ssh in as one non-root user (in this case, chris)_

2. _use `sudo su deploy_user` to switch to that deploy user_

3. _call `sudo ls` to run a command with sudo, without needing to provide a password_

I’m using Ansible 1.8.2, and deploying to an Ubuntu machine on Google Cloud Platform, and below is the relevant task I’m trying to run as well as my sudoers file.

If I want to log in with one non-root user, then run other commands as a deploy user, how else should I be doing this?

The best workaround I can think of at present is to execute the tasks as a login user, but make sure I set the owner and group as extra parameters for `file` or `template` tasks.

Many thanks,

Chris

tasks.yml

```auto

- name: put envdirs directory in place
file: >
path=~/path/to/envdir/
state=directory
mode=775
sudo: yes
sudo_user: "{{ deploy_user }}"
tags:
- debug

- name: drop envdir vars in directory
template: >
src=envdir_var.j2
dest=~/path/to/envdir//{{ item.env_var }}
with_items:
- { env_var: AWS_ACCESS_KEY_ID, env_val: "{{ aws_access_key }}" }
- { env_var: AWS_SECRET_ACCESS_KEY, env_val: "{{ aws_secret_key }}" }
- { env_var: AWS_DEFAULT_REGION, env_val: "{{ aws_region }}" }
- { env_var: PGUSER, env_val: "{{ app }}" }
- { env_var: PGPASSWORD, env_val: "{{ app }}" }
sudo: yes
sudo_user: "{{ deploy_user }}"

```

sudoers

```auto

~~~

# This file MUST be edited with the 'visudo' command as root.

#

# Please consider adding local content in /etc/sudoers.d/ instead of

# directly modifying this file.

#

# See the man page for details on how to write a sudoers file.

#

Defaults env_reset

Defaults mail_badpass

Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

 

# Host alias specification

 

# User alias specification

 

# Cmnd alias specification

 

# User privilege specification

root ALL=(ALL:ALL) ALL

 

# Members of the admin group may gain root privileges

%admin ALL=(ALL) ALL

 

# Allow members of group sudo to execute any command

%sudo ALL=(ALL:ALL) ALL

 

# See sudoers(5) for more information on "#include" directives:

 

#includedir /etc/sudoers.d

chris ALL=NOPASSWD: ALL

 

# this gives more access than I'd like to deploy_user, but ansible is

# still bitching about the deploy_user not having a sudo password

deploy_user ALL=NOPASSWD: ALL

```

---

<div class="post-metadata">

**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\
**Post date:** [February 10, 2015, 4:08am UTC](https://forum.ansible.com/t/how-should-i-use-sudo-user-and-sudo-together-when-logging-in-as-a-non-root-user-and-switching-to-another-user/17474/2 "2015-02-10T04:08:05Z")

</div>

Hi Chris, are you specifying the remote\_user value, or does the current user running Ansible on the controller match the remote user on the target system?