# remote user and become\_user is different, after ssh, become\_user should work.

**URL:** <https://forum.ansible.com/t/remote-user-and-become-user-is-different-after-ssh-become-user-should-work/27882>\
**Category:** Ansible Project\
**Created:** [June 27, 2018, 9:13am UTC](https://forum.ansible.com/t/remote-user-and-become-user-is-different-after-ssh-become-user-should-work/27882 "2018-06-27T09:13:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cemohanbabu](https://avatars.discourse-cdn.com/v4/letter/c/f4b2a3/32.png) [@cemohanbabu](https://forum.ansible.com/u/cemohanbabu)\
**Post date:** [June 27, 2018, 9:13am UTC](https://forum.ansible.com/t/remote-user-and-become-user-is-different-after-ssh-become-user-should-work/27882/1 "2018-06-27T09:13:37Z")

</div>

I’m confused with the use of become\_user.  
With config given in OP:

- the work that ansible will do is put into a python script on the remote machine, something like: /tmp/ansible…/setup.py
- that directory and file is created as the user “remote\_user” (only they and root has access).
- then we’re given the option to do “become\_user” (eg; postgres) to perform said tasks (…setup.py)
- BUT postgres doesnt have permissions to that file

So if the become\_user can’t ever access the setup.py - when would become\_user be useful ?

---

<div class="post-metadata">

**Author:** ![cemohanbabu](https://avatars.discourse-cdn.com/v4/letter/c/f4b2a3/32.png) [@cemohanbabu](https://forum.ansible.com/u/cemohanbabu)\
**Post date:** [June 27, 2018, 9:22am UTC](https://forum.ansible.com/t/remote-user-and-become-user-is-different-after-ssh-become-user-should-work/27882/2 "2018-06-27T09:22:49Z")

</div>

ERROR :: “msg”: “Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chown: /tmp/ansible-tmp-1530091102.27-83986154285412/: Operation not permitted.\nchown: /tmp/ansible-tmp-1530091102.27-83986154285412/setup.py: Operation not permitted.\n}). For information on working around this, see [https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user](https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user)”

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [June 28, 2018, 4:21pm UTC](https://forum.ansible.com/t/remote-user-and-become-user-is-different-after-ssh-become-user-should-work/27882/3 "2018-06-28T16:21:02Z")

</div>

It's documented here  
[https://docs.ansible.com/ansible/latest/user\_guide/become.html#becoming-an-unprivileged-user](https://docs.ansible.com/ansible/latest/user_guide/become.html#becoming-an-unprivileged-user)

---

<div class="post-metadata">

**Author:** ![cemohanbabu](https://avatars.discourse-cdn.com/v4/letter/c/f4b2a3/32.png) [@cemohanbabu](https://forum.ansible.com/u/cemohanbabu)\
**Post date:** [June 29, 2018, 11:11am UTC](https://forum.ansible.com/t/remote-user-and-become-user-is-different-after-ssh-become-user-should-work/27882/4 "2018-06-29T11:11:32Z")

</div>

Ways to resolve this include:

- Use . When pipelining is enabled, Ansible doesn’t save the module to a temporary file on the client. Instead it pipes the module to the remote python interpreter’s stdin. Pipelining does not work for python modules involving file transfer (for example: [copy](https://docs.ansible.com/ansible/latest/modules/copy_module.html#copy-module), [fetch](https://docs.ansible.com/ansible/latest/modules/fetch_module.html#fetch-module), [template](https://docs.ansible.com/ansible/latest/modules/template_module.html#template-module)), or for non-python modules.
- (Available in Ansible 2.1) Install POSIX.1e filesystem acl support on the managed host. If the temporary directory on the remote host is mounted with POSIX acls enabled and the **setfacl** tool is in the remote `PATH` then Ansible will use POSIX acls to share the module file with the second unprivileged user instead of having to make the file readable by everyone.
- Don’t perform an action on the remote machine by becoming an unprivileged user. Temporary files are protected by UNIX file permissions when you `become`root or do not use `become`. In Ansible 2.1 and above, UNIX file permissions are also secure if you make the connection to the managed machine as root and then use `become` to an unprivileged account.

Pipelining is not worked.

Don’t have idea on POSIX acl support, Could you pls elaborate how to install on AIX box.

FYI

My Case:

remote \_user : xxxxxxx able to ssh then after become\_user should have privileges to run ansible-tmp module.

but ansible-tmp file is created in /tmp folder which mentioned in Ansible.cfg file , by remote\_user: xxxxx with only read permission.

Error ::ERROR :: “msg”: “Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chown: /tmp/ansible-tmp-1530091102.27-83986154285412/: Operation not permitted.\nchown: /tmp/ansible-tmp-1530091102.27-83986154285412/setup.py: Operation not permitted.\n}). For information on working around this, see [https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user](https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user)”