# How to create an unprivileged user and intialize its GPG config? **URL:** \ **Category:** Ansible Project\ **Created:** [February 9, 2017, 5:07pm UTC](https://forum.ansible.com/t/how-to-create-an-unprivileged-user-and-intialize-its-gpg-config/23695 "2017-02-09T17:07:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Gabriel\_Birke](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@Gabriel\_Birke](https://forum.ansible.com/u/Gabriel_Birke)\ **Post date:** [February 9, 2017, 5:07pm UTC](https://forum.ansible.com/t/how-to-create-an-unprivileged-user-and-intialize-its-gpg-config/23695/1 "2017-02-09T17:07:06Z")
I’d like to create a user and import a GPG key into its GPG keychain. I thought the easiest way to do this would be to impersonate him, so the configuration and key files created by the gpg tool have the right onwership and permissions. My playbook steps look like this: - name: Create backup user user: name={{ backup\_user }} groups={{ backup\_group }} append=yes - name: Copy public key copy: src: files/some\_public\_key.asc dest: /home/{{ backup\_user}}/some\_public\_key.asc owner: “{{ backup\_user }}” - name: Import public key shell: gpg --import /home/{{ backup\_user}}/some\_public\_key.asc chdir: /home/{{ backup\_user}}/ become: yes become\_user: “{{ backup\_user }}” However, I’m getting a “Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user” error message. As a workaround I could call the gpg command a s a privileged user and later change the ownership of the .gnupg directory, but that feels kind of odd. Is there a better way to do this? ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [February 9, 2017, 5:58pm UTC](https://forum.ansible.com/t/how-to-create-an-unprivileged-user-and-intialize-its-gpg-config/23695/2 "2017-02-09T17:58:11Z")
Instead of becoming this user, can you already log in as this user at this point in time? Then setting the ansible\_user variable to the username and setting become to no would get ansible to log in as this user directly. But maybe you have not setup any kind of ssh authentication at this point, so this might not be possible... Johannes ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [February 9, 2017, 7:41pm UTC](https://forum.ansible.com/t/how-to-create-an-unprivileged-user-and-intialize-its-gpg-config/23695/3 "2017-02-09T19:41:33Z")
This page describe you alternatives [https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user](https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user) ---
**Author:** ![Gabriel\_Birke](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@Gabriel\_Birke](https://forum.ansible.com/u/Gabriel_Birke)\ **Post date:** [February 10, 2017, 9:14am UTC](https://forum.ansible.com/t/how-to-create-an-unprivileged-user-and-intialize-its-gpg-config/23695/4 "2017-02-10T09:14:58Z")
I’ve read the ways to resolve this, but I’m still struggling: - `setfacl` is available on the machine (in /usr/bin) and I’m using Ansible 2.2, so theoretically my playbook should work. Is there any way to check why it fails? - The docs say “In Ansible 2.1 and above, UNIX file permissions are also secure if you make the connection to the managed machine as root and then use become to an unprivileged account.” I guess this is only true for root and not for any privileged user? ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [February 11, 2017, 9:52am UTC](https://forum.ansible.com/t/how-to-create-an-unprivileged-user-and-intialize-its-gpg-config/23695/5 "2017-02-11T09:52:43Z")
One thing is to have setfacl installed, but have you enabled acl on the filesystem?