# sudo and change user

**URL:** <https://forum.ansible.com/t/sudo-and-change-user/26065>\
**Category:** Ansible Project\
**Created:** [November 17, 2017, 4:17pm UTC](https://forum.ansible.com/t/sudo-and-change-user/26065 "2017-11-17T16:17:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikos\_Skalis](https://avatars.discourse-cdn.com/v4/letter/n/e480ec/32.png) [@Nikos\_Skalis](https://forum.ansible.com/u/Nikos_Skalis)\
**Post date:** [November 17, 2017, 4:17pm UTC](https://forum.ansible.com/t/sudo-and-change-user/26065/1 "2017-11-17T16:17:15Z")

</div>

Could you please advise how

`usera@serverX:~> sudo su - userb Last login: Fri Nov 17 15:46:48 CET 2017 on pts/1 -bash-4.2$`  
(note that no password requested above)

translates into ansible ?

More specifically, I would like to login to linux server X as `usera` then become `userb` (with the command above), and then execute all the tasks defined in the playbook as `userb`

The following are configuration options in `ansible.cfg`:

sudo\_user = root  
#ask\_sudo\_pass = True  
#ask\_pass = True  
#remote\_user = root  
#become=True  
#become\_method=sudo  
#become\_user=root  
#become\_ask\_pass=False

I am having trouble understanding the difference between the above configuration options.

Niko

---

<div class="post-metadata">

**Author:** ![Moreno\_Garcia](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@Moreno\_Garcia](https://forum.ansible.com/u/Moreno_Garcia)\
**Post date:** [November 17, 2017, 11:40pm UTC](https://forum.ansible.com/t/sudo-and-change-user/26065/2 "2017-11-17T23:40:29Z")

</div>

I think you are looking for become\_user

[http://docs.ansible.com/ansible/latest/become.html](http://docs.ansible.com/ansible/latest/become.html)

---

<div class="post-metadata">

**Author:** ![Moreno\_Garcia](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@Moreno\_Garcia](https://forum.ansible.com/u/Moreno_Garcia)\
**Post date:** [November 17, 2017, 11:41pm UTC](https://forum.ansible.com/t/sudo-and-change-user/26065/3 "2017-11-17T23:41:19Z")

</div>

```auto
- name: Run a command as the userb user
  command: somecommand
  become: true
  become_user: userb

```

---

<div class="post-metadata">

**Author:** ![Nikos\_Skalis](https://avatars.discourse-cdn.com/v4/letter/n/e480ec/32.png) [@Nikos\_Skalis](https://forum.ansible.com/u/Nikos_Skalis)\
**Post date:** [November 18, 2017, 10:41am UTC](https://forum.ansible.com/t/sudo-and-change-user/26065/4 "2017-11-18T10:41:20Z")

</div>

as there is no password prompt, and “usera” is not a sudoer, the below will not work.

`sudo su - userb` is achievable because of PAM auth (meaning LDAP).  
I believe that is impossible this issue to be resolved at the playbook level.

I am trying to experiment with `-vvvv` and the options below, but with not much luck…

`sudo_flags` has been set to `-H`

here is some documentation:

sudo\_user =  
the default user to sudo to

ask\_sudo\_pass =  
this controls whether an Ansible playbook should prompt for a sudo password by default when sudoing

ask\_pass =  
controls whether an Ansible playbook should prompt for a password by default

remote\_user =  
This is the default username ansible will connect as for /usr/bin/ansible-playbook. Note that /usr/bin/ansible will always default to the current user if this is not defined

become =  
The equivalent of adding sudo: or su: to a play or task, set to true/yes to activate privilege escalation.

become\_method =  
Set the privilege escalation method. The default is sudo, other options are su, pbrun, pfexec, doas, ksu

become\_user =  
The equivalent to ansible\_sudo\_user or ansible\_su\_user, allows to set the user you become through privilege escalation.

become\_ask\_pass =  
Ask for privilege escalation password, the default is False

sudo\_flags =  
Note that ‘-n’ will conflict with using password-less sudo auth, such as pam\_ssh\_agent\_auth