# "sudo su user" and "sudo bash" for privilege escalation

**URL:** <https://forum.ansible.com/t/sudo-su-user-and-sudo-bash-for-privilege-escalation/20163>\
**Category:** Ansible Project\
**Created:** [January 9, 2016, 5:12am UTC](https://forum.ansible.com/t/sudo-su-user-and-sudo-bash-for-privilege-escalation/20163 "2016-01-09T05:12:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aneesh\_Joseph](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aneesh\_Joseph](https://forum.ansible.com/u/Aneesh_Joseph)\
**Post date:** [January 9, 2016, 5:12am UTC](https://forum.ansible.com/t/sudo-su-user-and-sudo-bash-for-privilege-escalation/20163/1 "2016-01-09T05:12:41Z")

</div>

In our org, privileged access is provided in the following way

For switching to the root user on DEV boxes,

_sudo bash_

For executing specific sudo commands, prefeix sudo to the command. Example  
_sudo yum install git_

For switching to a different user account, use sudo su  
_sudo su username_

I know that ansible doesn’t support this chaining very well(at least with old versions)

I’m currently using the below custom **su\_exe** script to support this

_#!/bin/sh_  
_if [$1 == “root”]; then_  
_#get rid of root -c_  
_shift 2_  
_sudo bash -c “$@”_

_else_  
_sudo su “$@”_  
_fi_

I have the below configuration in ansible.cfg

_[defaults]_  
_executable = /bin/bash_  
_host\_key\_checking = False_  
_su\_exe = ~/su.sh_

The playbook copies su.sh (the su executable) to the user’s home directory before triggering any task which has su set to yes

Are there any possible flaws in the way I’m trying to do this? Since su and sudo are deprecated, is there a way to do something similar using Ansible’s become? I’m currently using ansible-1.9.4-1.el6.noarch and I’m looking for a better way to accomplish the same 🙂