# Trying to use become

**URL:** <https://forum.ansible.com/t/trying-to-use-become/8527>\
**Category:** Get Help\
**Tags:** aws, ansible-core\
**Created:** [September 16, 2024, 8:22am UTC](https://forum.ansible.com/t/trying-to-use-become/8527 "2024-09-16T08:22:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jyrki](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@jyrki](https://forum.ansible.com/u/jyrki)\
**Post date:** [September 16, 2024, 8:22am UTC](https://forum.ansible.com/t/trying-to-use-become/8527/1 "2024-09-16T08:22:49Z")

</div>

Hi all

I’m having a bit of an issue with “become”. This server actually asks for the root password when sudo is invoked. Let me re-state: Not the login user password, the root password. When I login “manually” I see this:

```auto
  $ sudo su -
  [sudo] password for root:

```

I’m trying to use the ‘su’ become plugin. I keep getting

```auto
  'FAILED! => {"msg": "Timeout (12s) waiting for privilege escalation prompt:'

```

when trying to use become.

group\_vars looks like this:

```auto
  ---
  vars:
    ansible_become_method: 'su'
    ansible_user: 'login_user'
    ansible_become_exe: 'sudo -p "Password: " su -' ### saw this somewhere...

```

and the host vars looks like this:

```auto
  ---
  vars:
    b: "server-id"
    c: "project-id"
    r: "aws-region"
    ansible_host: "{{c}}_{{b}}"
    ansible_ssh_private_key_file: "~/.env/sec/ssh/w/{{c}}.{{r}}.pem"
    ansible_become_password: "{{ lookup('passwordstore',
    'services/aws/'+c+'/'+r+'/ec2/hosts/'+b+'/admin/root' ) }}"

```

Trying to run the most basic playbook ever (as root):

```auto
  ---
  - name: linux.os_version
    hosts: project-id_server-id
    become: true
    become_method: 'su'
    gather_facts: false
    tasks:
      - name: get os version
        ansible.builtin.shell: "pp=$(cat /etc/os-release | grep -i pretty) ; echo $pp | cut -d'=' -f2"
        register: osver
      - ansible.builtin.debug: var=osver.stdout_lines

```

That play is invoked like this:

` ansible-playbook $ansible_dir/linux.os_version.yml`

Been trying different variations of this and always getting the same result.  
The passwordstore plugin, I have tested, and I know it works.

```auto
ansible [core 2.17.3]
  config file = /home/user/ansible/ansible.cfg
  configured module search path = ['/home/user/ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.12/site-packages/ansible
  ansible collection location = /home/user/ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.12.5 (main, Aug 9 2024, 08:20:41) [GCC 14.2.1 20240805] (/usr/bin/python)
  jinja version = 3.1.4
  libyaml = True

```

If any kind soul would have it in them to tell me what I’m doing wrong, that would be most appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [September 16, 2024, 6:05pm UTC](https://forum.ansible.com/t/trying-to-use-become/8527/2 "2024-09-16T18:05:58Z")

</div>

The sudo and su become plugins do NOT allow for stacking methods. I advise to setup sudo OR su to allow for your usage as they are redundant. `sudo su - <user>` is the same as `sudo -i -u <user>` and you only have 1 surface area of attack (sudo).

But if you cannot change your setup, there is always [community.general.sudosu become – Run tasks using sudo su - — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/community/general/sudosu_become.html)

---

<div class="post-metadata">

**Author:** ![jyrki](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@jyrki](https://forum.ansible.com/u/jyrki)\
**Post date:** [September 16, 2024, 6:14pm UTC](https://forum.ansible.com/t/trying-to-use-become/8527/3 "2024-09-16T18:14:02Z")

</div>

thank you for the reply.

I indeed cannot change how sudo is setup.  
the `sudo su -` bit actually was there just to prove a point, but unfortunately it distracted from the goal.  
The idea is to use `su`.

I will try the sudosu plugin and see what happens.  
Thank you.

---

<div class="post-metadata">

**Author:** ![jyrki](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@jyrki](https://forum.ansible.com/u/jyrki)\
**Post date:** [September 19, 2024, 9:19pm UTC](https://forum.ansible.com/t/trying-to-use-become/8527/4 "2024-09-19T21:19:35Z")

</div>

So after a very long troubleshooting process, I’ve found the solution to my issues, and wanted to mark the post as solved.  
I actually learned about my issue in an non-accepted answer of an unrelated post on stackoverflow.

> <https://serverfault.com/questions/1045897/ansible-missing-sudo-password-even-with-passwordless-sudo-enabled>

so quite random tbh.

but what he says is true.  
I took the “vars:” line out in my group\_vars and host\_vars files, and it indeed solved my issue.

Thank you Brian for bothering to reply, your effort actually spurred me to begin challenging my assumptions about my setup.

best

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 19, 2024, 9:19pm UTC](https://forum.ansible.com/t/trying-to-use-become/8527/5 "2024-10-19T21:19:36Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.