# Making use of Ansible Privilege Escalation **URL:** \ **Category:** Ansible Project\ **Created:** [May 27, 2015, 5:19pm UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320 "2015-05-27T17:19:56Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Aneesh\_Joseph](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aneesh\_Joseph](https://forum.ansible.com/u/Aneesh_Joseph)\ **Post date:** [May 27, 2015, 5:19pm UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/1 "2015-05-27T17:19:56Z")
I’m trying to find the equivalent of ` ansible dev -a “/opt/pb/bin/pbrun su tomcat -c echo hi” -u aneesh ` (this works) I tried with ` ansible dev -a “echo hi” -u aneesh --become-user=tomcat–become-method=pbrun -b ` but it gave me the response “failed”: true, “msg”: "/bin/sh: pbrun: command not found\r\nOpenSSH\_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: mux\_client\_request\_session: master session id:… so I moved pbrun on the dev host to /bin/pbrun and now it shows the error “failed”: true, “msg”: "usage: pbrun [-D level] -h | -K | -k | -V\r\nusage: pbrun -v [-AknS] [-D level] [-g groupname|#gid] [-p prompt] [-u user\r\n name|#uid]\r\nusage: pbrun -l[l] [-AknS] [-D level] [-g groupname|#gid] [-p prompt] [-U user\r\n name] [-u user name|#uid] [-g groupname|#gid] [command]\r\n… Any idea how I can get this working? basically this is what I’m trying to do : `ansible@ansible>ssh aneesh@dev aneesh@dev. pbrun su tomcat tomcat@dev> echo hi` Thanks, Aneesh ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 28, 2015, 12:27pm UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/2 "2015-05-28T12:27:52Z")
ansible cannot chain privilege escalation methods, it can either use pbrun or su, but not both. pbrun should be able to allow you to execute all commands as a user w/o needing su. ---
**Author:** ![Aneesh\_Joseph](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aneesh\_Joseph](https://forum.ansible.com/u/Aneesh_Joseph)\ **Post date:** [June 4, 2015, 2:27am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/3 "2015-06-04T02:27:13Z")
Thanks Brian 🙂 I do have access to execute certain sudo commands without chaining privilege escalation methods. sudo -l gives me a list of what I can execute. But Ansible seems to be executing something other than this. For example I get the below error while running a playbook which has ‘sudo: yes’ set and it fails with the below error PLAY [ui] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* fatal: [myhost] =\> Missing become password Is there a way to find out what sudo command is being executed in the background? Thanks, Aneesh ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [June 4, 2015, 2:52am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/4 "2015-06-04T02:52:45Z")
use -vvvv to show the exact things being run, the message you are seeing implies you need to provide a sudo password ---
**Author:** ![Aneesh\_Joseph](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aneesh\_Joseph](https://forum.ansible.com/u/Aneesh_Joseph)\ **Post date:** [June 4, 2015, 5:02am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/5 "2015-06-04T05:02:16Z")
Thanks for the very quick response Brian. I see that it’s trying to execute sudo -k && sudo -H -S -p “[sudo via ansible, key=abcdefghijk] password: " **-u root /bin/sh** -c '”‘“‘echo BECOME-SUCCESS-abcdefghijk; LANG=C LC\_CTYPE=C /usr/bin/python /home/aneesh/.ansible/tmp/ansible-tmp-1433392081.2-227386081264121/setup; rm -rf /home/aneesh/.ansible/tmp/ansible-tmp-1433392081.2-227386081264121/ \>/dev/null 2\>&1’”’" Is there a way to make Ansible use **/bin/bash** instead of **/bin/sh** **sudo -l** tells me that I have **(root) NOPASSWD: /bin/bash** So I’m guessing that it should work if I’m able to change the shell using some config? ---
**Author:** ![benno\_joy](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@benno\_joy](https://forum.ansible.com/u/benno_joy)\ **Post date:** [June 4, 2015, 5:08am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/6 "2015-06-04T05:08:19Z")
try setting 'sudo\_exe=/bin/bash in ansible.cfg or export ANSIBLE\_SUDO\_EXE=/bin/bash in your cli and then running the playbook, usually /bin/sh is link to /bin/bash in centos/rhel systems. - Benno ---
**Author:** ![Aneesh\_Joseph](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aneesh\_Joseph](https://forum.ansible.com/u/Aneesh_Joseph)\ **Post date:** [June 4, 2015, 5:16am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/7 "2015-06-04T05:16:52Z")
Thanks Benno, I hope you meant setting ‘_executable = /bin/bash_’ in ansible.cfg? - Aneesh ---
**Author:** ![benno\_joy](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@benno\_joy](https://forum.ansible.com/u/benno_joy)\ **Post date:** [June 4, 2015, 5:32am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/8 "2015-06-04T05:32:25Z")
ohh sorry yes, the variable i mentioned is used to change the ‘sudo’ binary. - Benno ---
**Author:** ![Aneesh\_Joseph](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aneesh\_Joseph](https://forum.ansible.com/u/Aneesh_Joseph)\ **Post date:** [June 4, 2015, 6:57am UTC](https://forum.ansible.com/t/making-use-of-ansible-privilege-escalation/18320/9 "2015-06-04T06:57:32Z")
Thank you Benno and Brian, that worked perfectly 🙂 - Aneesh