# Sudoers File On Control Machine For Ansible User

**URL:** <https://forum.ansible.com/t/sudoers-file-on-control-machine-for-ansible-user/24055>\
**Category:** Ansible Project\
**Created:** [March 24, 2017, 12:08pm UTC](https://forum.ansible.com/t/sudoers-file-on-control-machine-for-ansible-user/24055 "2017-03-24T12:08:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gforster](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gforster/32/535_2.png) [@gforster](https://forum.ansible.com/u/gforster)\
**Post date:** [March 24, 2017, 12:08pm UTC](https://forum.ansible.com/t/sudoers-file-on-control-machine-for-ansible-user/24055/1 "2017-03-24T12:08:27Z")

</div>

Our boxes have one user for Ansible that has appropriate privileged escalations & SSH keys. This works fine, if you su - to that user. Otherwise, if you are yourself, you can only run plays by providing the passphrase for sudo and ssh. I’d like to have the Sudoers file (and appropriate bash aliases) on the control machine setup so that members of our team (all in a particular group in /etc/groups) can run ansible plays as themselves, but in reality be running them as the ansible user. This should be transparent to the members of the team i.e. they type “ansible-playbook someplay.yml” without having to type sudo or su or anything else.

I am having trouble getting this to work correctly. Are there any tips/tricks out there for doing this?

---

<div class="post-metadata">

**Author:** ![gforster](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gforster/32/535_2.png) [@gforster](https://forum.ansible.com/u/gforster)\
**Post date:** [March 24, 2017, 2:33pm UTC](https://forum.ansible.com/t/sudoers-file-on-control-machine-for-ansible-user/24055/2 "2017-03-24T14:33:21Z")

</div>

Figured it out. I think I had a typo…anyway, here’s what’s needed:

**in the sudoers file:**

Cmnd\_Alias ANSIBLECMNDS=/usr/bin/ansible,   
/usr/bin/ansible-console,   
/usr/bin/ansible-doc,   
/usr/bin/ansible-galaxy,   
/usr/bin/ansible-playbook,   
/usr/bin/ansible-pull,   
/usr/bin/ansible-vault

User\_Alias IDMADMINS=%ansible-admins-group-name

Runas\_Alias ANSIBLE=ansibleuser

ANSIBLEADMINS ALL = (ANSIBLE) NOPASSWD: ANSIBLECMNDS

**in the .bashrc or .bash\_profile or .bash\_aliases or profile.local or whatever you use:**

alias ansible=‘sudo -u ansibleuser /usr/bin/ansible’  
alias ansible-console=‘sudo -u ansibleuser /usr/bin/ansible-console’  
alias ansible-doc=‘sudo -u ansibleuser /usr/bin/ansible-doc’  
alias ansible-galaxy=‘sudo -u ansibleuser /usr/bin/ansible-galaxy’  
alias ansible-playbook=‘sudo -u ansibleuser /usr/bin/ansible-playbook’  
alias ansible-pull=‘sudo -u ansibleuser /usr/bin/ansible-pull’  
alias ansible-vault=‘sudo -u iansibleuser /usr/bin/ansible-vault’