# Problem with sudo su user

**URL:** <https://forum.ansible.com/t/problem-with-sudo-su-user/21419>\
**Category:** Ansible Project\
**Created:** [May 12, 2016, 11:51am UTC](https://forum.ansible.com/t/problem-with-sudo-su-user/21419 "2016-05-12T11:51:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jakub\_Zielinski](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@Jakub\_Zielinski](https://forum.ansible.com/u/Jakub_Zielinski)\
**Post date:** [May 12, 2016, 11:51am UTC](https://forum.ansible.com/t/problem-with-sudo-su-user/21419/1 "2016-05-12T11:51:33Z")

</div>

In sudoers file I have only (can’t change it)  
`%user ALL=(ALL) NOPASSWD: /bin/su - jboss`

How can I sudo to jboss and then run some command?  
I tried something like  
`- become: yes`  
`become_user: "jboss"`  
`raw: "touch test"`  
or  
`raw: "sudo su - jboss -c touch test"`  
but always ended:  
Sorry, user is not allowed to execute ‘command’ as jboss

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [May 14, 2016, 8:01pm UTC](https://forum.ansible.com/t/problem-with-sudo-su-user/21419/2 "2016-05-14T20:01:20Z")

</div>

This is being asked frequently, and AFAIK the only answer is:

You can't.

Ansible stuffs a lot of voodoo around the actual commands, so it needs  
your ansible\_user to have NOPASSWD set for all commands.

Workaround:  
You can store the become\_pass in an ansible-vault-encrypted file, so  
it can be given when sudo asks for it. This means your ansible\_user  
has to have the ability to issue all kinds of commands via sudo with  
being asked for the password.

Johannes

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [May 16, 2016, 9:52pm UTC](https://forum.ansible.com/t/problem-with-sudo-su-user/21419/3 "2016-05-16T21:52:52Z")

</div>

The problem here is that ansible does not support chaining privilege escalation methods (sudo OR su, not both).

%user ALL=(jboss) NOPASSWD: ALL

or

%user ALL=(jboss) ALL

would allow you to use sudo, or if you have the jboss user password you can use ‘su’, but Ansible cannot use the combination of the 2. Sadly this is a common pattern even though it is not needed as sudo can give you the same functionality w/o chaning su (as shown above).

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [May 17, 2016, 6:03pm UTC](https://forum.ansible.com/t/problem-with-sudo-su-user/21419/4 "2016-05-17T18:03:12Z")

</div>

I am sorry, I was unclear. I meant if you want \*passwordless\* sudo,  
you need it for all commands, not just for some.

Of course sudo with prompting for the password (which can be supplied  
in a lot of ways) works.

Johannes