# minimal sudoers configuration

**URL:** <https://forum.ansible.com/t/minimal-sudoers-configuration/16179>\
**Category:** Ansible Project\
**Created:** [September 11, 2014, 4:19am UTC](https://forum.ansible.com/t/minimal-sudoers-configuration/16179 "2014-09-11T04:19:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeff\_Weber](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@Jeff\_Weber](https://forum.ansible.com/u/Jeff_Weber)\
**Post date:** [September 11, 2014, 4:19am UTC](https://forum.ansible.com/t/minimal-sudoers-configuration/16179/1 "2014-09-11T04:19:11Z")

</div>

I’m working on finalizing an implementation of an ansible poc for a new  
project, and as part of this poc our security team has asked for a minimal  
sudoers configuration for the ansible automation user.

I’m currently using a “anything anywhere” type configuration, but looking  
at sudo logs I don’t believe I need this. Is there a project recommended  
minimal configuration for sudoers to allow only ansible commands? Browsing the  
documentation and mailing list nothing stood out, but maybe I missed it.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [September 11, 2014, 12:02pm UTC](https://forum.ansible.com/t/minimal-sudoers-configuration/16179/2 "2014-09-11T12:02:01Z")

</div>

Hi Jeff,

There’s a reference to this in the documentation on [http://docs.ansible.com/intro\_adhoc.html](http://docs.ansible.com/intro_adhoc.html) where it says “Rarely, some users have security”…

In any case, it’s usually not something valuable for the security team to enforce, because it also means you wouldn’t be able to install any packages (they contain %post scripts), use the shell module, or use the command module — because all of these would be able to run arbitrary commands.

We’d recommend using a specific user or key with Ansible, and controlling who gets that key, and constraining sudo differently (less) for them.

Further, use of Ansible Tower can keep the SSH private keys known only to admins and Tower, allowing people to be easily removed from the system without rekeying any of the remote hosts.

By comparison, it may also be useful to inform your security team that many other tools actually require full root level agents, so Ansible is one of the few options with a really strong sudo implementation (and su is also supported).

I’d recommend talking to them about how you can protect keys with Tower if needed, and also not give full access to users logging in normally.

–Michael