# Sudo to different user with nopasswd Fails and works only with root access **URL:** \ **Category:** Ansible Project\ **Created:** [April 9, 2015, 9:24pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946 "2015-04-09T21:24:04Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Rajasekhar\_Morla](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@Rajasekhar\_Morla](https://forum.ansible.com/u/Rajasekhar_Morla)\ **Post date:** [April 9, 2015, 9:24pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/1 "2015-04-09T21:24:04Z")
Hello All, I have been working to implement anisble solution to manage Apache and WCS. Through my playbook, I am logging into remote server with **myuser** and switching to **ihsadm** (which is apache admin) using sudo option and trying to restart apache. I have enabled NOPASSWD in my remote machine sudoer file so ansible doesn’t prompt for a password. My playbook works fine if my remote machine sudoer file has below setting myuser ALL=(ALL) NOPASSWD: ALL myuser ALL=(ALL) NOPASSWD: /bin/sh -c \* But, Above setting is equivalent to granting root access to myuser, which is essentially not the right way to do it. I only want to let **myuser** , to execute any task that **ihsadm** (apache owner) could execute, so to do this I have modified sudoer file as below. myuser ALL=(ALL) NOPASSWD: /bin/su - ihsadm Unfortunately above setting is not solving the problem, my playbook keeps on failing saying missing password. Please find below chunk of command being generated by ansible playbook… _/bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=bueeprcfcsyjwkzjiclhbckqvwvmshmczczcczcb] password: " -u ihsadm /bin/sh -c '”’“‘echo SUDO-SUCCESS-bueeprcfcsyjwkzjiclhbckqvwvmshmczczcczcb; LANG=C LC\_CTYPE=C /usr/bin/python /tmp/ansible-tmp-1428595758.95-133625262991075/command’”‘"’’_ I would really appreciate any inputs from you. Thanks, Raja ---
**Author:** ![Kathy\_Allen](https://avatars.discourse-cdn.com/v4/letter/k/839c29/32.png) [@Kathy\_Allen](https://forum.ansible.com/u/Kathy_Allen)\ **Post date:** [April 9, 2015, 9:57pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/2 "2015-04-09T21:57:41Z")
Sounds the situation I just posted about today: [https://groups.google.com/forum/#!topic/ansible-project/b\_RHAVYGv4o](https://groups.google.com/forum/#!topic/ansible-project/b_RHAVYGv4o) Looking forward to an answer. kallen ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [April 9, 2015, 10:07pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/3 "2015-04-09T22:07:25Z")
Raj, your sudoers entry is not usable by ansibl because it would have to chain su to sudo, you probably want this as an entry: myuser ALL = (ihsadm) NOPASSWD: ALL which allows your 'myuser' to run any command under ihsadm user while using sudo and it won't prompt for passwords. ---
**Author:** ![Martin2](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@Martin2](https://forum.ansible.com/u/Martin2)\ **Post date:** [April 9, 2015, 10:13pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/4 "2015-04-09T22:13:52Z")
Hi, This is actually a sudo config issue not an ansible issue. Note: This is all written from memory and untested. I hope you get the idea… ## sudo line myuser ALL=(ALL) NOPASSWD: ALL ## playbook ---
**Author:** ![Rajasekhar\_Morla](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@Rajasekhar\_Morla](https://forum.ansible.com/u/Rajasekhar_Morla)\ **Post date:** [April 9, 2015, 10:46pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/5 "2015-04-09T22:46:26Z")
Hi Martin, I thought it be nice to share my playbook with you to give u more idea. If you see the command I have shared earlier, ansible trying to sudo -u ihsadm only, but still it asks for password. Note: If I try to manually sudo to ihsadm I was not asked to enter password (with: myuser ALL=(ALL) NOPASSWD: /bin/su - ihsadm). #myplaybok ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [April 9, 2015, 10:50pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/6 "2015-04-09T22:50:45Z")
Rajasekhar, this setting: myuser ALL=(ALL) NOPASSWD: /bin/su - ihsadm will NOT WORK with ansible, this is not allowing ansible to sudo as a user, it allows you to use sudo to su into a user, which ansible does NOT chain sudo and su. sudo: yes sudo\_user: ihsadm is the equivalent of running all commands as "sudo -u ihsadm -c '\' ", it does not run su at all. ---
**Author:** ![Rajasekhar\_Morla](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@Rajasekhar\_Morla](https://forum.ansible.com/u/Rajasekhar_Morla)\ **Post date:** [April 9, 2015, 11:13pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/7 "2015-04-09T23:13:04Z")
Hi Brian, I am kind of confused here, could you please elaborate? What should be the setting/playbook option I should use it to work? Regards, Raja ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [April 9, 2015, 11:17pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/8 "2015-04-09T23:17:45Z")
none, as in my original email, the setting needs to be in your sudoers file: myuser ALL = (ihsadm) NOPASSWD: ALL ---
**Author:** ![Rajasekhar\_Morla](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@Rajasekhar\_Morla](https://forum.ansible.com/u/Rajasekhar_Morla)\ **Post date:** [April 9, 2015, 11:50pm UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/9 "2015-04-09T23:50:14Z")
Thanks Brian. This works but I think it is again letting ihsadm user to execute any command on the box which is equivalent to root. leads to, myuser user running commands as ihsadm rather than any user running any command. Regards, Raja ---
**Author:** ![Martin2](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@Martin2](https://forum.ansible.com/u/Martin2)\ **Post date:** [April 10, 2015, 12:13am UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/10 "2015-04-10T00:13:52Z")
Hi, > myuser ALL=(ALL) NOPASSWD: /bin/su - ihsadm > > will NOT WORK with ansible, this is not allowing ansible to sudo as a > user, it allows you to use sudo to su into a user, which ansible does > NOT chain sudo and su. > > sudo: yes > sudo\_user: ihsadm Brian, Are we talking about the same thing with different words? The sudo line above will: - make sudo accept to use any target user (-u to sudo) - will not make /bin/su magically exempt from /etc/pam.d/su – which by default only allows root a passwordless operation on most distros The sudo\_user (ihsadm) from ansible will: - “sudo -u ihsadm …” This combination leads to the situation where ansible will try to: - sudo -u $sudo\_user “/bin/su - ihsadm” \*\* Actually sudo -u $sudo\_user /path/to/generated/ansible-script.sh \*\* plus all the other options that ansible provides for sudo but those are the IMHO relevant things… which will fail miserably (read: will prompt for a password for the ihsadm user). Be it ansible or shell… I still stand by it: myuser ALL = (ALL) NOPASSWD: ALL is a superset of myuser ALL = (ihsadm) NOPASSWD: ALL from the POV sudo has. So it is a simple sudo issue and in no way related to ansible… Regards, Martin ---
**Author:** ![Martin2](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@Martin2](https://forum.ansible.com/u/Martin2)\ **Post date:** [April 10, 2015, 12:20am UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/11 "2015-04-10T00:20:25Z")
Hi, So you probably want a combination of a proper sudo rule and the remote\_tmp1 configuration? Something along the lines of: myuser ALL = (ihsadm) NOPASSWD: ~ihsadm/.ansible/tmp/\* This will probably make some modules harder to use… /Martin ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [April 10, 2015, 12:34am UTC](https://forum.ansible.com/t/sudo-to-different-user-with-nopasswd-fails-and-works-only-with-root-access/17946/12 "2015-04-10T00:34:48Z")
Martin, you are correct about it being a superset, I might have misunderstood that what Raja wanted was to give myuser the ability to run as ihsadm but not as root. My setting was INSTEAD, not in addition to the existing ones.