# Run script that requires 'sudo' on remote hosts. **URL:** \ **Category:** Ansible Project\ **Created:** [March 27, 2019, 8:29pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002 "2019-03-27T20:29:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![R-JRI](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@R-JRI](https://forum.ansible.com/u/R-JRI)\ **Post date:** [March 27, 2019, 8:29pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/1 "2019-03-27T20:29:38Z")
Hi, all We have an application stop/start script that starts/stops application without root privilege and with ‘sudo’. If I am on the host, I login as the application user and then run the script to stop/start application as ‘sudo application\_stop\_start.sh stop/start’. On the ansible server (v2.7), I created a simple test file. The application user ID is the same on ansible host and remote node (ssh authentication has no problem) tasks: - name: run script to stop/start application command: sudo /usr/local/bin/application\_stop\_start.sh stop It ran successfully on the remote host with a warning message. PLAY [Stop application] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ok: [host1] TASK [run application\_stop\_start.sh script to stop application] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* [WARNING]: Consider using ‘become’, ‘become\_method’, and ‘become\_user’ rather than running sudo changed: [host1] PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* host1 : ok=2 changed=1 unreachable=0 failed=0 I don’t need ‘become’ and ‘become\_user’ at least since the UID is the same. Tried to use ‘become\_method = sudo’ and remove ‘sudo’ from ‘command: /usr/local/bin/application\_stop\_start.sh stop’ and it did not work. Does anyone have any suggestions? Thanks. ---
**Author:** ![Sebastian\_Meyer](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@Sebastian\_Meyer](https://forum.ansible.com/u/Sebastian_Meyer)\ **Post date:** [March 27, 2019, 8:57pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/2 "2019-03-27T20:57:38Z")
> I don't need 'become' and 'become\_user' at least since the UID is the same. > Tried to use 'become\_method = sudo' and remove 'sudo' from 'command: > /usr/local/bin/application\_stop\_start.sh stop' and it did not work. Does > anyone have any suggestions? > Thanks. You still need `become: true`, since you want to \_become\_ root executing this script. Just setting the become\_method to sudo won't do anything. Sebastian ---
**Author:** ![Raghavendra\_Rao](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@Raghavendra\_Rao](https://forum.ansible.com/u/Raghavendra_Rao)\ **Post date:** [March 27, 2019, 9:03pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/3 "2019-03-27T21:03:40Z")
> Hi, all > > We have an application stop/start script that starts/stops application without root privilege and with ‘sudo’. > If I am on the host, I login as the application user and then run the script to stop/start application as ‘sudo application\_stop\_start.sh stop/start’. > > On the ansible server (v2.7), I created a simple test file. The application user ID is the same on ansible host and remote node (ssh authentication has no problem) > > tasks: > > - name: run script to stop/start application > command: sudo /usr/local/bin/application\_stop\_start.sh stop > > It ran successfully on the remote host with a warning message. > > PLAY [Stop application] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > ok: [host1] > TASK [run application\_stop\_start.sh script to stop application] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > [WARNING]: Consider using ‘become’, ‘become\_method’, and ‘become\_user’ rather than running sudo > changed: [host1] > PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > host1 : ok=2 changed=1 unreachable=0 failed=0 > > I don’t need ‘become’ and ‘become\_user’ at least since the UID is the same. ‘become’ is used for privilege escalation. Meaning “Whether to automatically switch user on the managed host (typically to root) after connecting”. Though you have same UIDs on both control node and managed host, don’t forget that the UID on managed host needs root privileges to run ‘application\_stop\_start.sh’ (as you are running sudo to run that command normally as well). > Tried to use ‘become\_method = sudo’ and remove ‘sudo’ from ‘command: /usr/local/bin/application\_stop\_start.sh stop’ and it did not work. Does anyone have any suggestions? You need to inform ansible about these two things: become = true become\_user = root become\_method = sudo Put this under ansible.cfg of your pwd and it should run fine. -R.Rao ---
**Author:** ![R-JRI](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@R-JRI](https://forum.ansible.com/u/R-JRI)\ **Post date:** [March 28, 2019, 1:45pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/4 "2019-03-28T13:45:35Z")
Hi, Sebastian I did not say clearly. I checked my ansible.cfg and it has ‘become = true’ in it and ran failed. ---
**Author:** ![R-JRI](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@R-JRI](https://forum.ansible.com/u/R-JRI)\ **Post date:** [March 28, 2019, 1:49pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/5 "2019-03-28T13:49:27Z")
Hi, Raghavendra Added ‘become\_user = root’ in ansible.cfg and ran failed with below message: TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* fatal: [host1]: FAILED! =\> {“changed”: false, “module\_stderr”: “Shared connection to host1 closed.\r\n”, “module\_stdout”: “Sorry, user appsadmin is not allowed to execute ‘/bin/sh -c echo BECOME-SUCCESS-fxdiujleiigrbgciqkixarzuxhsbngrr; /usr/bin/python /u/appadmin/.ansible/tmp/ansible-tmp-1553780641.69-82349845573466/AnsiballZ\_setup.py’ as root on host1.\r\n”, “msg”: “MODULE FAILURE\nSee stdout/stderr for the exact error”, “rc”: 1} ---
**Author:** ![Sebastian\_Meyer](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@Sebastian\_Meyer](https://forum.ansible.com/u/Sebastian_Meyer)\ **Post date:** [March 28, 2019, 2:21pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/6 "2019-03-28T14:21:15Z")
Hi, > TASK [Gathering Facts] > \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > fatal: [host1]: FAILED! =\> {"changed": false, "module\_stderr": "Shared > connection to host1 closed.\r\n", "module\_stdout": "Sorry, user appsadmin > is not allowed to execute '/bin/sh -c echo > BECOME-SUCCESS-fxdiujleiigrbgciqkixarzuxhsbngrr; /usr/bin/python > /u/appadmin/.ansible/tmp/ansible-tmp-1553780641.69-82349845573466/AnsiballZ\_setup.py' > as root on host1.\r\n", "msg": "MODULE FAILURE\nSee stdout/stderr for the > exact error", "rc": 1} If the user you use with ansible is only allowed to execute this script with sudo and not use sudo for ALL, then you are right to use command: sudo /usr/local/bin/application\_stop\_start.sh stop You may want to add warn: no See: [https://docs.ansible.com/ansible/latest/modules/command\_module.html?highlight=warn](https://docs.ansible.com/ansible/latest/modules/command_module.html?highlight=warn) Sebastian ---
**Author:** ![R-JRI](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@R-JRI](https://forum.ansible.com/u/R-JRI)\ **Post date:** [March 28, 2019, 3:23pm UTC](https://forum.ansible.com/t/run-script-that-requires-sudo-on-remote-hosts/30002/7 "2019-03-28T15:23:16Z")
Thanks Sebastian. I added warning option as you suggested and the warning message went away and applications can be stopped/started.