Running playbooks with sudo vs root

Archives Ansible Project
1

Hello,

I am working on setting up ansible in my environment and would like to know if there is a strong advantage to using sudo with playbooks rather than logging in directly as root? Some advantages that come to mind are:

  • protecting the root account from direct access or brute force password attacks; however this is not an issue in my environment because root has no password set; rather only the ansible user’s ssh key is stored in the root account, so access to root is limited to the ansible server
  • sudo allows you to log all commands and who ran them, however you can also log which ssh key connected by setting LogLevel to VERBOSE in sshd_config
  • if you were running a playbook that did not require any superuser access, then it would make sense to run it as regular user and not use sudo

Is there something else I am missing?

Thanks,

Andrew

2

This is a bit of a religious discussion between Red Hat and Debian/Ubuntu camps :slight_smile:

IMHO logging in with root and an authorized key is fine, but I would probably not suggest logging in with root and a password.

Ansible will be logging activity to syslog in either event.

3

Thanks for the clarification!