# Privileges for become\_user **URL:** \ **Category:** Ansible Project\ **Created:** [September 12, 2019, 11:47am UTC](https://forum.ansible.com/t/privileges-for-become-user/31269 "2019-09-12T11:47:39Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Torsten\_Lorenz](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Torsten\_Lorenz](https://forum.ansible.com/u/Torsten_Lorenz)\ **Post date:** [September 12, 2019, 11:47am UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/1 "2019-09-12T11:47:39Z")
Hi @ all, i try to start/stop a service with ansible adn need to execute the comand with sudo: executing “sudo /usr/bin/systemctl start filebeat.service” works pretty fine, but i would like to use the service-modul. My playbook looks like this: ` ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [September 12, 2019, 12:07pm UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/2 "2019-09-12T12:07:57Z")
Hi The user you connect as ('becomeuser' - I suppose that's obfuscated) isn't allowed to do sudo. If you fix that things are likely to start working. On a related note, you can remove become\_user as that it set to its default (root), as well as become\_method, which default to sudo. So basically just "become: true" is needed. Dick ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 12, 2019, 12:15pm UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/3 "2019-09-12T12:15:14Z")
Make sure user "sudouser" is able to become root with "sudo su".       me@master: ssh sudouser@hostname       sudouser@hostname: sudo su       root@hostname: Take a look at /etc/sudoers. You can run "sudo /usr/bin/systemctl ..." because this command it's specifically allowed, I guess. HTH, Cheers,   -vlado ---
**Author:** ![Torsten\_Lorenz](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Torsten\_Lorenz](https://forum.ansible.com/u/Torsten_Lorenz)\ **Post date:** [September 12, 2019, 12:19pm UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/4 "2019-09-12T12:19:44Z")
Hi, thanks for your answer. the user is allowed to use sudo. If i change my playbook to: ` tasks: - name: restart Filebeat per Command shell: “sudo /usr/bin/systemctl start filebeat.service filebeat.service” ` its working, but thats not more than a workarround… I think the problem is, that the sudo-template exactly contains the command “/usr/bin/systemctl \* filebeat.service filebeat.service” an ansible uses any other command to start/stop the service greetz ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [September 12, 2019, 12:33pm UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/5 "2019-09-12T12:33:33Z")
That is correct, ansible is hard (or impossible) to use with such a restrictive environment: [https://docs.ansible.com/ansible/latest/user\_guide/become.html#id13](https://docs.ansible.com/ansible/latest/user_guide/become.html#id13) ---
**Author:** ![RAVITZ](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@RAVITZ](https://forum.ansible.com/u/RAVITZ)\ **Post date:** [September 12, 2019, 1:27pm UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/6 "2019-09-12T13:27:25Z")
Use become:true next line of hosts at header. ---
**Author:** ![Torsten\_Lorenz](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Torsten\_Lorenz](https://forum.ansible.com/u/Torsten_Lorenz)\ **Post date:** [September 13, 2019, 6:54am UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/7 "2019-09-13T06:54:30Z")
OK, the sudo-configuration in our enviroment is pretty strict, so i´m sure, that we couldn´t work with ansible in this cases. “Sudo su” to become root isn´t allowed. thanks a lot ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 13, 2019, 7:58am UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/8 "2019-09-13T07:58:44Z")
Hi, FYI, there are other plugins [https://docs.ansible.com/ansible/latest/plugins/become.html#plugin-list](https://docs.ansible.com/ansible/latest/plugins/become.html#plugin-list) How are you going to "become" root? Just curious to learn the limitations of Ansible. Thank you,   -vlado ---
**Author:** ![Torsten\_Lorenz](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Torsten\_Lorenz](https://forum.ansible.com/u/Torsten_Lorenz)\ **Post date:** [September 13, 2019, 8:13am UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/9 "2019-09-13T08:13:02Z")
Hi, ih´ve already seen this page and think that become\_exe is what i´m searching for. But i´m not able to download this plugin, the github-page is not available. Thats how i log in and use sudo-commands manuel on this system: → Login with my personal user (No Sudo-privileges) → Sudo su - sudouser → Type sudo /usr/bin/systemctl start filebeat.service ansible uses the sudouser directly to execute commands on the remote servers… ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 13, 2019, 8:36am UTC](https://forum.ansible.com/t/privileges-for-become-user/31269/10 "2019-09-13T08:36:04Z")
Well, when you're not allowed to "become" root then you are not allowed to configure the system and as result you can´t "work with ansible in this cases". Cheers,   -vlado