# Issue with a shell command

**URL:** <https://forum.ansible.com/t/issue-with-a-shell-command/37789>\
**Category:** Ansible Project\
**Created:** [March 21, 2023, 11:52am UTC](https://forum.ansible.com/t/issue-with-a-shell-command/37789 "2023-03-21T11:52:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![harry\_devine](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/harry_devine/32/5293_2.png) [@harry\_devine](https://forum.ansible.com/u/harry_devine)\
**Post date:** [March 21, 2023, 11:52am UTC](https://forum.ansible.com/t/issue-with-a-shell-command/37789/1 "2023-03-21T11:52:14Z")

</div>

We have a role that implements the CIS benchmarks on our systems. When we get to the following play, we get the error described below:

- name: Disable System Accounts - preparation  
ansible.builtin.shell: |  
set -o pipefail && awk -F’:’ |  
($3\<500 && $1!=“root” && $1!=“sync” && $1!=“shutdown” && $1!=“sync” && $1!=“shutdown” && $1!=“halt” && $7!=“/sbin/nologin”) { print $1 } /etc/passwd  
register: enabled\_system\_accounts  
changed\_when: false

Error:

awk: cmd. line:1: |  
awk: cmd. line:1: ^ syntax error  
/bin/sh: -c: line 1: syntax error near unexpected token `{' /bin/sh: -c: line 1: `($3\<500 && $1!=“root” && $1!=“sync” && $1!=“shutdown” && $1!=“sync” && $1!=“shutdown” && $1!=“halt” && $7!=“/sbin/nologin”) { print $1 } /etc/passwd’

Any ideas?

Thanks,  
Harry

---

<div class="post-metadata">

**Author:** ![Will\_McDonald](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Will\_McDonald](https://forum.ansible.com/u/Will_McDonald)\
**Post date:** [March 21, 2023, 12:25pm UTC](https://forum.ansible.com/t/issue-with-a-shell-command/37789/2 "2023-03-21T12:25:12Z")

</div>

I suspect your problem is simply that your shell command’s incorrectly quoted and something like:

ansible.builtin.shell: |  
set -o pipefail && awk -F’:’ '($3\<500 && $1!=“root” && $1!=“sync” && $1!=“shutdown” && $1!=“sync” && $1!=“shutdown” && $1!=“halt” && $7!=“/sbin/nologin”) { print $1 } ’ /etc/passwd

Note the additional quotes.

[https://github.com/major/ansible-role-cis/blob/master/tasks/section\_07\_level1.yml](https://github.com/major/ansible-role-cis/blob/master/tasks/section_07_level1.yml) mostly matches your snippet but uses simpler formatting/quoting as an example.

[https://github.com/major/ansible-role-cis](https://github.com/major/ansible-role-cis) appears to be deprecated, as does [https://github.com/major/cis-rhel-ansible](https://github.com/major/cis-rhel-ansible)

It might also be worth including:

1. What target operating system release(s) you’re targeting and
2. What versions of upstream CIS roles you’re using.

---

<div class="post-metadata">

**Author:** ![harry\_devine](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/harry_devine/32/5293_2.png) [@harry\_devine](https://forum.ansible.com/u/harry_devine)\
**Post date:** [March 21, 2023, 3:14pm UTC](https://forum.ansible.com/t/issue-with-a-shell-command/37789/3 "2023-03-21T15:14:35Z")

</div>

I was able to get past that issue, but now the next play is erroring out:

- name: Disable System Accounts - preparation  
ansible.builtin.shell: |  
set -o pipefail && awk -F’:’ ‘($3\<500 && $1!=“root” && $1!=“sync” && $1!=“shutdown” && $1!=“sync” && $1!=“shutdown” && $1!=“halt” && $7!=“/sbin/nologin”) { print $1 }’ /etc/passwd  
register: enabled\_system\_accounts  
changed\_when: false

- name: Disable System Accounts  
ansible.builtin.user:  
name: “{{ item }}”  
shell: /sbin/nologin  
with\_items: “{{ enabled\_system\_accounts.stdout\_lines }}”  
when: enabled\_system\_accounts.stdout\_lines is defined

The “Disable System Accounts” is giving me “The task includes an option with an undefined variable. The error was: ‘item’ is undefined”. I’m assuming that the “enabled\_system\_accounts” is not defined or available at this point? Any thoughts on how to get past this?

Thanks,  
Harry

---

<div class="post-metadata">

**Author:** ![Alex\_Wanderley](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alex_wanderley/32/3232_2.png) [@Alex\_Wanderley](https://forum.ansible.com/u/Alex_Wanderley)\
**Post date:** [March 21, 2023, 3:42pm UTC](https://forum.ansible.com/t/issue-with-a-shell-command/37789/4 "2023-03-21T15:42:46Z")

</div>

Hello,

If you debug/print the whole content of “enabled\_system\_accounts” what do you see?  
Is “enabled\_system\_accounts.stdout\_lines” being populated?

Alex

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [March 21, 2023, 4:25pm UTC](https://forum.ansible.com/t/issue-with-a-shell-command/37789/5 "2023-03-21T16:25:41Z")

</div>

with\_items is incorrectly indented