# Trouble using with\_items and when: stdout == 0

**URL:** <https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213>\
**Category:** Ansible Project\
**Created:** [September 13, 2014, 10:19pm UTC](https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213 "2014-09-13T22:19:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patrick\_Ansible-ML](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Patrick\_Ansible-ML](https://forum.ansible.com/u/Patrick_Ansible-ML)\
**Post date:** [September 13, 2014, 10:19pm UTC](https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213/1 "2014-09-13T22:19:46Z")

</div>

Hi,

I'm trying to do two simple things:  
- check if a user is present in sshd\_config AllowUsers  
- if not, add the user to the AllowUsers line

Sounds simple enough yet my Ansible foo is still lacking severly. The problem is that the last task is always skipped.

vars:

allowusers:  
&nbsp;&nbsp;&nbsp;- testuser  
&nbsp;&nbsp;&nbsp;- patrick

tasks:

- name: Check if build user is in ssh AllowUsers  
&nbsp;&nbsp;&nbsp;shell: grep -i -m1 -c {{ item }} /etc/ssh/sshd\_config  
&nbsp;&nbsp;&nbsp;with\_items: allowusers  
&nbsp;&nbsp;&nbsp;ignore\_errors: True  
&nbsp;&nbsp;&nbsp;register: check\_allowusers

- debug: var=check\_allowusers

- name: Add user to AllowUsers  
&nbsp;&nbsp;&nbsp;shell: "sed -i 's|^AllowUsers |AllowUsers {{ item }} |' /etc/ssh/sshd\_config"  
&nbsp;&nbsp;&nbsp;with\_items: check\_allowusers.results  
&nbsp;&nbsp;&nbsp;when: item.stdout == 0

Here is the output from debug: var=check\_allowusers:

TASK: [builder | debug var=check\_allowusers] \*\*\*\*  
ok: [test.local] =\> {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"check\_allowusers": {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"changed": true,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"failed": true,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"msg": "One or more items failed.",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"results": [  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"changed": true,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"cmd": "grep -i -m1 -c testuser /etc/ssh/sshd\_config",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"delta": "0:00:00.005375",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"end": "2014-09-13 20:03:37.564863",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"invocation": {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"module\_args": "grep -i -m1 -c testuser /etc/ssh/sshd\_config",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"module\_name": "shell"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;},  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"item": "testuser",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"rc": 1,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"start": "2014-09-13 20:03:37.559488",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"stderr": "",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"stdout": "0"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;},  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"changed": true,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"cmd": "grep -i -m1 -c patrick /etc/ssh/sshd\_config",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"delta": "0:00:01.005767",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"end": "2014-09-13 20:03:38.671370",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"invocation": {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"module\_args": "grep -i -m1 -c patrick /etc/ssh/sshd\_config",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"module\_name": "shell"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;},  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"item": "patrick",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"rc": 0,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"start": "2014-09-13 20:03:37.665603",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"stderr": "",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"stdout": "1"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
}

If there isn't a better best practice way to do this then how do I make this work?

Thanks,  
Patrick

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [September 14, 2014, 1:38pm UTC](https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213/2 "2014-09-14T13:38:11Z")

</div>

The stdout in one case is “0” and another is “1” so this seems to be working as designed.

As such, I think this would be the way your system is setup (aka it works correctly) or your grep needs modification.

Ansible _appears_ to be doing what you want.

---

<div class="post-metadata">

**Author:** ![Patrick\_Ansible-ML](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Patrick\_Ansible-ML](https://forum.ansible.com/u/Patrick_Ansible-ML)\
**Post date:** [September 14, 2014, 2:30pm UTC](https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213/3 "2014-09-14T14:30:03Z")

</div>

Hi Michael,

Thank you for your feedback.

> The stdout in one case is "0" and another is "1" so this seems to be  
> working as designed.
> 
> As such, I think this would be the way your system is setup (aka it  
> works correctly) or your grep needs modification.
> 
> Ansible \*appears\* to be doing what you want.

Tried more stuff and got a useful error. It appears that Ansible does not pass in the \*name\* from the 'allowuser' list as item in the sed command but instead throws in \*all\* the 'results' text:

"cmd": "sed -i 's|^AllowUsers |AllowUsers {u'changed': True, ...

Obviously that will make sed fail. So what do I need to change to make it use just the name from the 'allowuser' list?

Full error:

TASK: [builder | builder | Add user to AllowUsers]

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [September 14, 2014, 4:58pm UTC](https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213/4 "2014-09-14T16:58:26Z")

</div>

Yeah you will have to do “item.something” to not get the full hash result, like item.rc or item.stdout or item.cmd, as appropriate…

---

<div class="post-metadata">

**Author:** ![Patrick\_Ansible-ML](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Patrick\_Ansible-ML](https://forum.ansible.com/u/Patrick_Ansible-ML)\
**Post date:** [September 14, 2014, 9:39pm UTC](https://forum.ansible.com/t/trouble-using-with-items-and-when-stdout-0/16213/5 "2014-09-14T21:39:06Z")

</div>

Thanks Michael. That put me on the right track. Here's what gave the expected results:

- name: builder | Add user to AllowUsers  
&nbsp;&nbsp;&nbsp;shell: "sed -i 's|^AllowUsers |AllowUsers {{ item.item }} |' /etc/ssh/sshd\_config"  
&nbsp;&nbsp;&nbsp;with\_items: check\_allowusers.results  
&nbsp;&nbsp;&nbsp;when: item.stdout == "0"  
&nbsp;&nbsp;&nbsp;notify: restart sshd

Cheers,  
Patrick