# How to run "sudo command" as ssh user without switching to become\_user?

**URL:** <https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881>\
**Category:** Ansible Project\
**Created:** [March 1, 2018, 9:57pm UTC](https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881 "2018-03-01T21:57:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin1](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kevin1](https://forum.ansible.com/u/Kevin1)\
**Post date:** [March 1, 2018, 9:57pm UTC](https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881/1 "2018-03-01T21:57:32Z")

</div>

Hi,  
I’m connecting to my host as “user1” and my become user name is “user2”. The only account that has sudo privs to run the “do-something” command is _user1_.

> **Attempt 1:**  
> I’m trying to run the following task, but it doesn’t work because ansible isn’t providing the password to the host and it sits there until it times out:
> 
> > task:
> 
> > > - name: apply configurator on {{ inventory\_hostname }}
> 
> > > become: false
> 
> > > shell: “sudo /usr/bin/do-something”
> 
> ```auto
> 
> ```
> 
> > ```auto
> > output:
> > 
> > ```
> 
> > >
> 
> ```auto
> 
> ```
> 
> ```auto
> **Attempt 2:**
> 
> ```
> 
> ```auto
> I then tried to run the following task, but it doesn't work because it runs as *user2*, but that's not what I want because *user2* doesn't have sudo privs:
> 
> ```
> 
> ```auto
> 
> ```
> 
> > ```auto
> > task:
> > 
> > ```
> 
> > ```auto
> > 
> > > - name: apply configurator on {{ inventory_hostname }}
> > 
> > ```
> 
> > ```auto
> > 
> > > become: true
> > 
> > ```
> 
> > ```auto
> > 
> > > shell: "/usr/bin/do-something"
> > 
> > ```
> 
> ```auto
> 
> ```
> 
> ````auto
> 
> > ```
> > output:
> > ```
> 
> ````
> 
> ```auto
> 
> > > fatal: [host]: FAILED! => {"changed": true, "cmd": "/usr/bin/do-something", "delta": "0:00:00.027783", "end": "2018-03-01 21:46:58.719945", "msg": "non-zero return code", "rc": 126, "start": "2018-03-01 21:46:58.692162", "stderr": "/bin/sh: /usr/bin/do-something: Permission denied", "stderr_lines": ["/bin/sh: /usr/bin/do-something: Permission denied"], "stdout": "", "stdout_lines": []} 
> 
> ```
> 
> ```auto
> 
> ```
> 
> ````auto
> 
> ```
> **Attempt 3:**
> ```
> 
> ````
> 
> ```auto
> 
> I then try to run the following task, but it hangs as it waits for credentials for *user2*'s password, which ansible will not provide (even it it worked):
> 
> ```
> 
> ```auto
> 
> ```
> 
> > ```auto
> > 
> > task:
> > 
> > ```
> 
> > ````auto
> > 
> > ```
> > 
> > > - name: apply configurator on {{ inventory_hostname }}
> > 
> > ```
> > 
> > ````
> 
> > ````auto
> > 
> > ```
> > 
> > > become: true
> > 
> > ```
> > 
> > ````
> 
> > ````auto
> > 
> > ```
> > 
> > > shell: "sudo /usr/bin/do-something"
> > 
> > ```
> > 
> > ````
> 
> ````auto
> 
> ```
> 
> ```
> 
> ````
> 
> ````auto
> 
> > ```
> > output:
> > ```
> 
> ````
> 
> ```auto
> 
> > > <times-out> 
> 
> ```

```auto

  I've even tried setting the become_user to *user1*, but that doesn't work either. Using "sudo" in the shell command causes it to hang because a prompt for password is waiting whereas keeping "sudo" out gets me another permission error.

  Any help is greatly appreciated.

Thanks,
Kevin
 

```

---

<div class="post-metadata">

**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\
**Post date:** [March 1, 2018, 11:58pm UTC](https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881/2 "2018-03-01T23:58:22Z")

</div>

Try adding this to your /etc/sudoers file so you don’t get prompted  
some\_user ALL=(ALL) NOPASSWD: ALL

---

<div class="post-metadata">

**Author:** ![Kevin1](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kevin1](https://forum.ansible.com/u/Kevin1)\
**Post date:** [March 2, 2018, 2:46am UTC](https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881/3 "2018-03-02T02:46:17Z")

</div>

Hi Tony,  
Thanks for the tip. Unfortunately, I can’t modify this file, but I did find a solution! Although, it does look like there may be a bug in Ansible (version 2.4.2.0).

It’s worth noting that I had the following in my inventory group vars file:

> ansible\_become\_user: user2

I tried the following task:

> - name: Configurator command needs to be run  
> become\_user: root  
> shell: “/usr/bin/do-something”

Which also didn’t work because ansible reported that I didn’t have privileges (same error as I reported above with attempts 2).

Later, I removed then ansible\_become\_user variable setting from my inventory group vars file and re-ran the task with success!

Looking at the [variable precedence documentation](http://docs.ansible.com/ansible/latest/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable), it says that task variable settings are higher precedence then inventory group variables.

I’m I looking at this the wrong way? Or shouldn’t this have worked by setting the become\_user to root in the task no matter what’s in the inventory group vars file?

Thanks,  
Kevin

---

<div class="post-metadata">

**Author:** ![Kevin1](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@Kevin1](https://forum.ansible.com/u/Kevin1)\
**Post date:** [March 2, 2018, 3:29am UTC](https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881/4 "2018-03-02T03:29:42Z")

</div>

Hi,  
Ok, clearly I’m a newbie!

I changed the inventory group vars to the following and it works as expected:

> become\_user: user2

The documentation reads as if ansible\_become\_user and become\_user are synonyms of each other. Clearly not!

Thanks,  
Kevin

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [March 2, 2018, 4:50pm UTC](https://forum.ansible.com/t/how-to-run-sudo-command-as-ssh-user-without-switching-to-become-user/26881/5 "2018-03-02T16:50:05Z")

</div>

They are not the same, but they are related, 'ansible\_become\_user' is  
a 'connection variable' which has higher precedence than 'become\_user'  
which is a playbook keyword.

The former is meant to be specific to a host/group of hosts to provide  
a way to deal with heterogeneous environments, the latter is a way to  
make play/task specific usage and expected to work in more homogeneous  
environments.