# Running playbooks with sudo vs root

**URL:** <https://forum.ansible.com/t/running-playbooks-with-sudo-vs-root/13758>\
**Category:** Ansible Project\
**Created:** [October 24, 2013, 1:14am UTC](https://forum.ansible.com/t/running-playbooks-with-sudo-vs-root/13758 "2013-10-24T01:14:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\
**Post date:** [October 24, 2013, 1:14am UTC](https://forum.ansible.com/t/running-playbooks-with-sudo-vs-root/13758/1 "2013-10-24T01:14:42Z")

</div>

Hello,

I am working on setting up ansible in my environment and would like to know if there is a strong advantage to using sudo with playbooks rather than logging in directly as root? Some advantages that come to mind are:

- protecting the root account from direct access or brute force password attacks; however this is not an issue in my environment because root has no password set; rather only the ansible user’s ssh key is stored in the root account, so access to root is limited to the ansible server
- sudo allows you to log all commands and who ran them, however you can also log which ssh key connected by setting LogLevel to VERBOSE in sshd\_config
- if you were running a playbook that did not require any superuser access, then it would make sense to run it as regular user and not use sudo

Is there something else I am missing?

Thanks,

Andrew

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [October 24, 2013, 3:38am UTC](https://forum.ansible.com/t/running-playbooks-with-sudo-vs-root/13758/2 "2013-10-24T03:38:05Z")

</div>

This is a bit of a religious discussion between Red Hat and Debian/Ubuntu camps 🙂

IMHO logging in with root and an authorized key is fine, but I would probably not suggest logging in with root and a password.

Ansible will be logging activity to syslog in either event.

---

<div class="post-metadata">

**Author:** ![Andrew\_Martin](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Andrew\_Martin](https://forum.ansible.com/u/Andrew_Martin)\
**Post date:** [October 24, 2013, 1:38pm UTC](https://forum.ansible.com/t/running-playbooks-with-sudo-vs-root/13758/3 "2013-10-24T13:38:28Z")

</div>

Thanks for the clarification!