# Separate "users" for normal and "sudo" operations **URL:** \ **Category:** Ansible Project\ **Created:** [November 9, 2013, 9:55am UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872 "2013-11-09T09:55:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mikhail\_Sobolev](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Mikhail\_Sobolev](https://forum.ansible.com/u/Mikhail_Sobolev)\ **Post date:** [November 9, 2013, 9:55am UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/1 "2013-11-09T09:55:48Z")
Hi, I have a setup where the remote sites are cygwin machines. The main problem is that sudo is not available in any way (at least, I could not find any information on how to achieve this kind of functionality). The question is: is it possible to use a different user to connect to the target machine to perform operations requiring “sudo”? ---
**Author:** ![Jim\_Richardson](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@Jim\_Richardson](https://forum.ansible.com/u/Jim_Richardson)\ **Post date:** [November 10, 2013, 6:05am UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/2 "2013-11-10T06:05:34Z")
I am not clear on what you are asking for. You can run a playbook as any user ( that you have the credentials for ) Perhaps you could give more details on what it is you are asking for? ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [November 11, 2013, 5:23pm UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/3 "2013-11-11T17:23:39Z")
in more recent ansible, you can set ‘remote\_user:’ at a task level and use that instead of sudo you also have ‘runas.exe’ as a kind of sudo substitute on windows. ---
**Author:** ![Kesten\_Broughton2](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Kesten\_Broughton2](https://forum.ansible.com/u/Kesten_Broughton2)\ **Post date:** [November 13, 2013, 2:16pm UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/4 "2013-11-13T14:16:55Z")
I have had issues with sudo / normal users causing conflicts. At first I made two copies of the playbook and had one with sudo, one without, but that is terrible for maintenance. The per-task sudo: yes can be helpful for local actions, and per-task remote\_user will be handy too. But for running entire playbooks as either sudo or root… The problem i faced was that i sometimes run as root and sometimes as a sudo user, and unfortunately, unlike a unix shell where running a sudo command as root is fine, ansible errors out with something like “invalid output was: [sudo via ansible, key=gxdfdfcyogebthrkocompltleramynjw] password: Sorry, try again.” My solution now is to set all tasks with - hosts: foo sudo: “{{use\_sudo}}” and pass in use\_sudo as an extra var ala, ansible-playbook -i hosts site.yml --extra-vars=“use\_sudo=yes”. But it would be nice if ansible just made it possible to run sudo commands as root like normal unix. Here is a more complete context of the problem i was trying to solve. admin\_user is the sometimes root, sometimes sudo user that can add new users. It failed until I added the “use\_sudo” arg as outlined above. ansible-playbook -i hosts playbooks/utils/sudo\_useradd.yml --extra-vars=“hosts=bespin\_cluster user=ansible pwd=\*\*\* admin\_user=root sudo\_pwd=required” in sudo\_useradd.yml - hosts: “{{hosts}}” vars: pwd\_sudo\_line: “%sudo ALL=(ALL) ALL” no\_pwd\_sudo\_line: “%sudo ALL=(ALL) NOPASSWD: ALL” sudoers\_line: “{{pwd\_sudo\_line}}” # default, can be over-ridden user: “{{admin\_user}}” sudo: yes tasks: TASK: [Add the desired lines] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* failed: [bespin] =\> {“failed”: true, “item”: “”, “parsed”: false} failed: [Linux-Elasticsearch] =\> {“failed”: true, “item”: “”, “parsed”: false} invalid output was: [sudo via ansible, key=gxdfdfcyogebthrkocompltleramynjw] password: Sorry, try again. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [November 13, 2013, 2:27pm UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/5 "2013-11-13T14:27:27Z")
in latest devel Already is sudo would not have changed the user it is a noop. – Michael ---
**Author:** ![Mikhail\_Sobolev](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@Mikhail\_Sobolev](https://forum.ansible.com/u/Mikhail_Sobolev)\ **Post date:** [December 16, 2013, 6:51pm UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/6 "2013-12-16T18:51:08Z")
Thanks everyone for suggestions (I was a bit away madly doing manual upgrades :)). So far using different ‘remote\_user’ for tasks that do not require special privileges and for those that do sounds exactly what I was looking for (sorry, Jim, I did not describe my problem better). ---
**Author:** ![vineet](https://avatars.discourse-cdn.com/v4/letter/v/8e8cbc/32.png) [@vineet](https://forum.ansible.com/u/vineet)\ **Post date:** [September 17, 2014, 8:18am UTC](https://forum.ansible.com/t/separate-users-for-normal-and-sudo-operations/13872/7 "2014-09-17T08:18:07Z")
Hi, I was facing the same issue until i changed the privilges of normal user to ‘ALL’ in sudoers file. Now ansible playbook doesn’t asks for passwords for this user.