# Understanding of REMOTE\_USER II: Command ID in the managed host **URL:** \ **Category:** Ansible Project\ **Created:** [October 7, 2019, 5:57pm UTC](https://forum.ansible.com/t/understanding-of-remote-user-ii-command-id-in-the-managed-host/31431 "2019-10-07T17:57:49Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Vicente\_Dominguez](https://avatars.discourse-cdn.com/v4/letter/v/bbe5ce/32.png) [@Vicente\_Dominguez](https://forum.ansible.com/u/Vicente_Dominguez)\ **Post date:** [October 7, 2019, 5:57pm UTC](https://forum.ansible.com/t/understanding-of-remote-user-ii-command-id-in-the-managed-host/31431/1 "2019-10-07T17:57:49Z")
Hello everybody, Regarding the understanding of how the REMOTE\_USER works in managed hosts… I’ve created a playbook which executes the command ID, with the aim of knowing who is the user executing the action in the managed host. ![Captura2.PNG](https://us1.discourse-cdn.com/ansible/original/2X/7/7abc346f4eac61b57fef671236b614760f850275.png) I have 2 nodes with the following users: Control Node: ANSIBLE - ROOT Managed Host: ANSIBLE - SSHUSER - ROOT When I run the playbook, I get the follow results: ![Captura.PNG](https://us1.discourse-cdn.com/ansible/original/2X/5/5671693f27ca0fbf814f9ac064db77331b00dd4d.png) So my question is, why is the user ANSIBLE (managed host’s user) the one executing the task in [HOST1.EXAMPLE.COM](http://HOST1.EXAMPLE.COM), if I didn’t specify REMOTE\_USER= ANSIBLE? **Why ANSIBLE, and not SSHUSER??** (for sure If I write -b (become), ROOT will be the one executing the action) Thank you very much in advance! ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [October 7, 2019, 6:41pm UTC](https://forum.ansible.com/t/understanding-of-remote-user-ii-command-id-in-the-managed-host/31431/2 "2019-10-07T18:41:42Z")
See "Ansible remote\_user vs ansible\_user" for clarification of the plethora of users [https://stackoverflow.com/questions/36668756/ansible-remote-user-vs-ansible-user](https://stackoverflow.com/questions/36668756/ansible-remote-user-vs-ansible-user) Couple notes: \* Best practice is to run ansible on controller as unprivileged user (not   root) who will automatically become "ansible\_user" (if not overridden in   the inventory). \* ansible will ssh ansible\_user@remote if not overridden by --user option on   the command line, or in the play (remote\_user) \* In most cases the privileges are escalated with "become\_\*" options after   unprivileged user (ansible\_user or remote\_user) establishes connection to   the remote host. "See Understanding Privilege Escalation"   [https://docs.ansible.com/ansible/latest/user\_guide/become.html#understanding-privilege-escalation](https://docs.ansible.com/ansible/latest/user_guide/become.html#understanding-privilege-escalation) \* The standard chain is: ansible\_user -\> remote\_user -\> become\_user Cheers,   -vlado ---
**Author:** ![Vicente\_Dominguez](https://avatars.discourse-cdn.com/v4/letter/v/bbe5ce/32.png) [@Vicente\_Dominguez](https://forum.ansible.com/u/Vicente_Dominguez)\ **Post date:** [October 7, 2019, 7:42pm UTC](https://forum.ansible.com/t/understanding-of-remote-user-ii-command-id-in-the-managed-host/31431/3 "2019-10-07T19:42:24Z")
Thank you Vladimir for your quick and useful answer! I’ve understood the basis now, but… it raises the question below: Let’s imagine that I don’t have ANSIBLE user on the managed host, as follows: –\>Control Node: ANSIBLE - ROOT –\>Managed Host: SSHUSER - ROOT Taking into account that I am not overriding any “user” kind variables (either remote\_user in playbooks or ansible\_user in the inventory)… What would happen if I am ANSIBLE in the Control Node, and I run the ID Command on the Managed Host with no priv. escalation? If ANSIBLE is my default “ansible\_user” and It establishes a SSH connection like [ANSIBLE@host1.example.com](mailto:ANSIBLE@host1.example.com)… It would prompt an error because the user does not exists on the managed host, wouldn’t it? (I don’t want to try deleting Ansible user with the aim of not changing the test environment as much as possible) Thank you very much in advance… your help is really apreciated. Regards, Vicente. ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [October 7, 2019, 8:27pm UTC](https://forum.ansible.com/t/understanding-of-remote-user-ii-command-id-in-the-managed-host/31431/4 "2019-10-07T20:27:39Z")
Yes, it would. That's the --user option for. For example   $ ansible host1.example.com --user SSHUSER --module-name setup ---
**Author:** ![Vicente\_Dominguez](https://avatars.discourse-cdn.com/v4/letter/v/bbe5ce/32.png) [@Vicente\_Dominguez](https://forum.ansible.com/u/Vicente_Dominguez)\ **Post date:** [October 7, 2019, 9:21pm UTC](https://forum.ansible.com/t/understanding-of-remote-user-ii-command-id-in-the-managed-host/31431/5 "2019-10-07T21:21:35Z")
Exacly! I’ve created a new user (usertest) on the Control Node and tried to connect to the managed node, with the same conditions as before (ansible user with no priv. escalation nor ansible\_user var defined). Result → SSH raised an authentication error =) Thank you Vladimir.