# sudo not being used on remote host **URL:** \ **Category:** AWX Project\ **Created:** [February 9, 2022, 5:17pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313 "2022-02-09T17:17:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Ralph\_Hershkowitz](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@Ralph\_Hershkowitz](https://forum.ansible.com/u/Ralph_Hershkowitz)\ **Post date:** [February 9, 2022, 5:17pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/1 "2022-02-09T17:17:10Z")
I am on server A logged in as user A with sudo permissions. I am attempting to run a privileged command on server b as user A. User A on server b also has sudo permissions. However I am getting permission errors: - **Inventory File** [rhershkow@if21d0002 ansible]$ more inventory if21d0001 ansible\_ssh\_user=rhershkow- **Config File** [rhershkow@if21d0002 ansible]$ more ansible.cfg [defaults] inventory = /home/rhershkow/demo/ansible/inventory [privilege\_escalation] become=true become\_method=sudo become\_user=rhershkow become\_ask\_pass=False- **Example.yml** [rhershkow@if21d0002 ansible]$ more example.yml name: New user is created hosts: if21d0001 become: true tasks: - name: User gets created user: name: test state: present- **Execution Errors** [rhershkow@if21d0002 ansible]$ ansible-playbook example.yml PLAY [New user is created] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ok: [if21d0001] TASK [User gets created] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* fatal: [if21d0001]: FAILED! =\> {“changed”: false, “msg”: “useradd: Permission denied.\nuseradd: cannot lock /etc/passwd; try again later.\n”, “name”: “test”, “rc”: 1} to retry, use: --limit @/home/rhershkow/demo/ansible/example.retry PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* if21d0001 : ok=1 changed=0 unreachable=0 failed=1 ---
**Author:** ![jowestco](https://avatars.discourse-cdn.com/v4/letter/j/85f322/32.png) [@jowestco](https://forum.ansible.com/u/jowestco)\ **Post date:** [February 9, 2022, 8:41pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/2 "2022-02-09T20:41:39Z")
If I am reading this correctly, it appears that you are using an ssh user of rhershkow from your inventory but then in your ansible.cfg file you are using become\_user=rhershkow. This would tell ansible to sudo into the user rhershkow (i.e. sudo -u rhershkow ). Doe the rhershkow user have permissions to run useradd? You likely want to just omit the become\_user value as that would let Ansible try and user sudo without the -u option. Please let us know if this helps. In addition, this sounds more like a general Ansible question (instead of an AWX question). Please refer to [https://www.ansible.com/community](https://www.ansible.com/community) for some of the other mailing lists available, most likely a question like this should be sent to ansible-project mailing list. -John ---
**Author:** ![Ralph\_Hershkowitz](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@Ralph\_Hershkowitz](https://forum.ansible.com/u/Ralph_Hershkowitz)\ **Post date:** [February 9, 2022, 8:57pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/3 "2022-02-09T20:57:07Z")
rhershkow does not have adduser permissions by itself but does have sudo. Question is how can I get Ansible to use sudo when running the useradd? ---
**Author:** ![Patrick\_Dreher](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Patrick\_Dreher](https://forum.ansible.com/u/Patrick_Dreher)\ **Post date:** [February 10, 2022, 2:00pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/4 "2022-02-10T14:00:32Z")
Not sure if you checked the documentation on the topic already ([https://docs.ansible.com/ansible/latest/user\_guide/become.html](https://docs.ansible.com/ansible/latest/user_guide/become.html)) Your goal is to ssh with the user rhershkow and for privilege escalation you want to use sudo. To achieve that you wouldn’t need to configure anything in the ansible.cfg since sudo would be the default become plugin, that is used. ansible.cfg: _[defaults]_ _inventory = /home/rhershkow/demo/ansible/inventory_ _[privilege\_escalation]_ _become=true_ **makes every task run with escalated privileges and doesn’t make a difference, since you also defined ‘become: true’ in your playbook** _become\_method=sudo_ **default** _become\_user=rhershkow_ **this is probably what causes your error** _become\_ask\_pass=False_ **default** So, you can remove the whole _[privilege\_escalation]_ section from your config and it should do what you expect. As John also described already, at the moment you are basically using sudo to become the rhershkow instead of root - that’s why you aren’t allowed to create the user. ---
**Author:** ![Ralph\_Hershkowitz](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@Ralph\_Hershkowitz](https://forum.ansible.com/u/Ralph_Hershkowitz)\ **Post date:** [February 10, 2022, 6:52pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/5 "2022-02-10T18:52:16Z")
Tried this but still getting errors: [rhershkow@if21d0002 ansible]$ more ansible.cfg [defaults] inventory = /home/rhershkow/demo/ansible/inventory [rhershkow@if21d0002 ansible]$ ansible-playbook example.yml PLAY [New user is created] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* fatal: [if21d0001]: FAILED! =\> {“changed”: false, “module\_stderr”: “Shared connection to if21d0001 closed.\r\n”, “module\_stdout”: “Sorry, user rhershkow is not allowed to execute ‘/bin/sh -c echo BECOME-SUCCESS-mtbaqhdtglwsyaknythnllvxiexciehc; /usr/bin/python /home/rhershkow/.ansible/tmp/ansible-tmp-1644519085.4-23992700985121/setup.py; rm -rf "/home/rhershkow/.ansible/tmp/ansible-tmp-1644519085.4-23992700985121/" \> /dev/null 2\>&1’ as root on if21d0001.\r\n”, “msg”: “MODULE FAILURE”, “rc”: 1} to retry, use: --limit @/home/rhershkow/demo/ansible/example.retry PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* if21d0001 : ok=0 changed=0 unreachable=0 failed=1 [rhershkow@if21d0002 ansible]$ ---
**Author:** ![Patrick\_Dreher](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Patrick\_Dreher](https://forum.ansible.com/u/Patrick_Dreher)\ **Post date:** [February 10, 2022, 9:28pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/6 "2022-02-10T21:28:41Z")
Well, can the user create a user if you try it manually? ---
**Author:** ![Patrick\_Dreher](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Patrick\_Dreher](https://forum.ansible.com/u/Patrick_Dreher)\ **Post date:** [February 10, 2022, 9:38pm UTC](https://forum.ansible.com/t/sudo-not-being-used-on-remote-host/36313/7 "2022-02-10T21:38:44Z")
also you are failing at gathering tasks now, which was working previously. Is there a restrictive sudoers config in place, that only allows for certain commands? you might want to try and move the ‘become: true’ line to only the user task. That’s where you actually need it. At the moment you have it set for the whole play. - name: New user is created hosts: if21d0001 tasks: - name: User gets created user: name: test state: present become: true however, it should generally still work no matter where you define it. If your user is only allowed to run certain commands via sudo this will obviously cause some problems tho.