# Ideal permissions setup?

**URL:** <https://forum.ansible.com/t/ideal-permissions-setup/15886>\
**Category:** Ansible Project\
**Created:** [August 8, 2014, 5:44am UTC](https://forum.ansible.com/t/ideal-permissions-setup/15886 "2014-08-08T05:44:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gary\_Malouf](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@Gary\_Malouf](https://forum.ansible.com/u/Gary_Malouf)\
**Post date:** [August 8, 2014, 5:44am UTC](https://forum.ansible.com/t/ideal-permissions-setup/15886/1 "2014-08-08T05:44:24Z")

</div>

Today, we have a setup where all of our playbooks, roles, etc are owned and run by root on our ‘management instance’. Some important key files are protected/encrypted in the root home directory that playbooks need to access at times - this is why we root owns this. To allow others to run certain playbooks, we have given them specific sudo access for those exact commands, put them in scripts and version controlled them.

Our ideal world is to have two groups of users:

1. Can deploy, start/stop components via playbooks across the board without specific whitelisting (but not access the root keys)
2. Users in groups that allow them to run certain playbooks but not others

Just wondering how other people are managing this?

---

<div class="post-metadata">

**Author:** ![Vitaliy\_Zhhuta](https://avatars.discourse-cdn.com/v4/letter/v/ba8739/32.png) [@Vitaliy\_Zhhuta](https://forum.ansible.com/u/Vitaliy_Zhhuta)\
**Post date:** [August 8, 2014, 10:42am UTC](https://forum.ansible.com/t/ideal-permissions-setup/15886/2 "2014-08-08T10:42:55Z")

</div>

for such kind of tasks Ansible created Tower [http://www.ansible.com/tower](http://www.ansible.com/tower)

Пʼятниця, 8 серпня 2014 р. 08:44:24 UTC+3 користувач Gary Malouf написав:

---

<div class="post-metadata">

**Author:** ![Gary\_Malouf](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@Gary\_Malouf](https://forum.ansible.com/u/Gary_Malouf)\
**Post date:** [August 8, 2014, 1:39pm UTC](https://forum.ansible.com/t/ideal-permissions-setup/15886/3 "2014-08-08T13:39:39Z")

</div>

I hear that, but atm we can not afford to go that direction. I was more asking what users who have not been able to afford the commercial product are doing in the mean-time.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 8, 2014, 2:41pm UTC](https://forum.ansible.com/t/ideal-permissions-setup/15886/4 "2014-08-08T14:41:37Z")

</div>

I’m not going to sell things on this list, but pricing has recently been updated if you have not checked recently - so it might actually make sense for you.

It’s a lot more complex to get this right than you think, so it may be worthwhile if you have such needs.