# Sudo option hangs when running simple shell commands

**URL:** <https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553>\
**Category:** Ansible Project\
**Created:** [September 25, 2013, 6:37pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553 "2013-09-25T18:37:00Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\
**Post date:** [September 25, 2013, 6:37pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/1 "2013-09-25T18:37:00Z")

</div>

This hangs and I have to kill the process. I don’t want to use -K since I’d rather use passwordless ssh.

# ansible -i hosts webserver1 -m shell -a “/sbin/service httpd restart” --sudo

Now, if I pass the sudo command via the shell, it works just fine.

# ansible -i hosts webserver1 -m shell -a “sudo /sbin/service httpd restart”

---

<div class="post-metadata">

**Author:** ![Walid](https://avatars.discourse-cdn.com/v4/letter/w/ea5d25/32.png) [@Walid](https://forum.ansible.com/u/Walid)\
**Post date:** [September 25, 2013, 6:49pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/2 "2013-09-25T18:49:56Z")

</div>

which connection transport are you using? did you try differnet ones, and try to use the new -vvvv option to debug ssh connections

---

<div class="post-metadata">

**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\
**Post date:** [September 25, 2013, 6:52pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/3 "2013-09-25T18:52:11Z")

</div>

Looks like I’m stuck here …

ESTABLISH CONNECTION FOR USER: deployment on PORT 22 TO oqn-01-web1  
 EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-1380135044.57-157834591122680 && chmod a+rx $HOME/.ansible/tmp/ansible-1380135044.57-157834591122680 && echo $HOME/.ansible/tmp/ansible-1380135044.57-157834591122680’  
 REMOTE\_MODULE command /sbin/service httpd restart  
 PUT /tmp/tmppxQ9cr TO /home/deploy/.ansible/tmp/ansible-1380135044.57-157834591122680/command  
 EXEC /bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=gjnesgjnrperpmifmojteiocwhyyfsrj] password: " -u root /bin/sh -c '”’“‘/usr/bin/python /home/deploy/.ansible/tmp/ansible-1380135044.57-157834591122680/command; rm -rf /home/deploy/.ansible/tmp/ansible-1380135044.57-157834591122680/ \>/dev/null 2\>&1’”‘"’’

---

<div class="post-metadata">

**Author:** ![James\_Cammarata1](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@James\_Cammarata1](https://forum.ansible.com/u/James_Cammarata1)\
**Post date:** [September 25, 2013, 8:33pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/4 "2013-09-25T20:33:20Z")

</div>

You need to specify -K when using sudo, as it is waiting at a prompt for a sudo password.

---

<div class="post-metadata">

**Author:** ![Sam\_S](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@Sam\_S](https://forum.ansible.com/u/Sam_S)\
**Post date:** [September 25, 2013, 8:38pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/5 "2013-09-25T20:38:12Z")

</div>

But I thought if I’m using passwordless SSH it shouldn’t matter?

---

<div class="post-metadata">

**Author:** ![James\_Cammarata1](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@James\_Cammarata1](https://forum.ansible.com/u/James_Cammarata1)\
**Post date:** [September 25, 2013, 8:40pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/6 "2013-09-25T20:40:04Z")

</div>

It does, because sudo may not be passwordless. Using -k is for ssh, -K is for sudo.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [September 25, 2013, 11:52pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/7 "2013-09-25T23:52:37Z")

</div>

Always why I prefer long form options every time 🙂

---

<div class="post-metadata">

**Author:** ![Phil\_Franks](https://avatars.discourse-cdn.com/v4/letter/p/ee59a6/32.png) [@Phil\_Franks](https://forum.ansible.com/u/Phil_Franks)\
**Post date:** [November 18, 2013, 7:06pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/8 "2013-11-18T19:06:10Z")

</div>

Sorry to be digging up an old thread. I ran into this issue to and the issue is not always simply sudo/password/-K issue.

sudo is often configured to only allow certain commands to run via sudo. For example, a developer that may restart a web service, but not administer the rest of the system. After tracing logs, I believe ansible does not support this.

For example, sudo is configured with the follow authorisation:  
**%tomcat7 ALL=(ALL) NOPASSWD: /usr/sbin/service tomcat7 restart**

**User runs ‘sudo service tomcat7 restart’ in a shell directly:**  
==\> /var/log/auth.log \<==  
Nov 18 18:49:46 host sudo: username : TTY=pts/0 ; PWD=/home/username ; USER=root ; COMMAND=/usr/sbin/service tomcat7 restart  
Nov 18 18:49:46 host sudo: pam\_unix(sudo:session): session opened for user root by username(uid=0)  
Nov 18 18:49:52 host sudo: pam\_unix(sudo:session): session closed for user root

**Ansible playbook task service: name=tomcat7 state=restarted:**  
==\> /var/log/auth.log \<==  
Nov 18 18:48:54 host sudo: username : TTY=pts/6 ; PWD=/home/username ; USER=root ; COMMAND=/bin/sh -c echo SUDO-SUCCESS-uwsxighxnhfaaspfrokwpdvxgnjycdil; /usr/bin/python

The ansible call is wrapped and sudo called using /bin/sh which sudo does not allow.

Is there a workaround for this, other than granting the user sudo access to everything?

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [November 20, 2013, 3:59am UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/9 "2013-11-20T03:59:22Z")

</div>

“sudo is often configured to only allow certain commands to run via sudo”

Correct, this is not how ansible works.

We simply don’t invoke chown, modules are reusable pieces of code and we don’t require them to be preinstalled.

---

<div class="post-metadata">

**Author:** ![Jacob\_Weber1](https://avatars.discourse-cdn.com/v4/letter/j/94ad74/32.png) [@Jacob\_Weber1](https://forum.ansible.com/u/Jacob_Weber1)\
**Post date:** [April 26, 2014, 6:45pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/10 "2014-04-26T18:45:33Z")

</div>

Sorry to bring up this old thread again, but I’m running into the same issue as Phil.

I’d like to have a user that has sudo access to restart Apache but not, say, delete it.

How do people typically handle this? Is it possible to create users that can run ansible modules like “service” as sudo, without having sudo rights to run every command?

Or is the expectation that Ansible should have full sudo access?

JW

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [April 28, 2014, 2:05pm UTC](https://forum.ansible.com/t/sudo-option-hangs-when-running-simple-shell-commands/13553/11 "2014-04-28T14:05:37Z")

</div>

I’m sorry, you can’t define sudo access to do specific commands this way.