# Using sudo with pam-ssh-agent-auth after sudo\_flags is removed?

**URL:** <https://forum.ansible.com/t/using-sudo-with-pam-ssh-agent-auth-after-sudo-flags-is-removed/26209>\
**Category:** Ansible Project\
**Created:** [December 5, 2017, 8:31pm UTC](https://forum.ansible.com/t/using-sudo-with-pam-ssh-agent-auth-after-sudo-flags-is-removed/26209 "2017-12-05T20:31:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Pick](https://avatars.discourse-cdn.com/v4/letter/c/c89c15/32.png) [@Chris\_Pick](https://forum.ansible.com/u/Chris_Pick)\
**Post date:** [December 5, 2017, 8:31pm UTC](https://forum.ansible.com/t/using-sudo-with-pam-ssh-agent-auth-after-sudo-flags-is-removed/26209/1 "2017-12-05T20:31:16Z")

</div>

In my project’s “ansible.cfg” I set “sudo\_flags = -H -S” to remove the “-n” option so that sudo works with pam-ssh-agent-auth (as suggested in [this issue](https://github.com/ansible/ansible/issues/17216) and in [the docs](https://docs.ansible.com/ansible/latest/intro_configuration.html#sudo-flags)).

When I run `ansible-playbook` (version 2.4.2.0) it reports the following warning:

> [DEPRECATION WARNING]: DEFAULT\_SUDO\_FLAGS option, In favor of become which is a generic framework .  
> This feature will be removed in version 2.8. Deprecation warnings can be disabled by setting  
> deprecation\_warnings=False in ansible.cfg.

I don’t see any “become\_flags” (or similar) option, nor do I think that would be an appropriate place to change this setting as this really is a sudo-specific flag.

My question is: what I should do when 2.8 is released, is there an alternative that will allow sudo to continue to work with pam-ssh-agent-auth?

Thanks for any thoughts, -Chris

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [December 5, 2017, 8:40pm UTC](https://forum.ansible.com/t/using-sudo-with-pam-ssh-agent-auth-after-sudo-flags-is-removed/26209/2 "2017-12-05T20:40:02Z")

</div>

[https://docs.ansible.com/ansible/2.4/config.html#default-become-flags](https://docs.ansible.com/ansible/2.4/config.html#default-become-flags)

---

<div class="post-metadata">

**Author:** ![Chris\_Pick](https://avatars.discourse-cdn.com/v4/letter/c/c89c15/32.png) [@Chris\_Pick](https://forum.ansible.com/u/Chris_Pick)\
**Post date:** [December 5, 2017, 8:55pm UTC](https://forum.ansible.com/t/using-sudo-with-pam-ssh-agent-auth-after-sudo-flags-is-removed/26209/3 "2017-12-05T20:55:44Z")

</div>

Thanks, that works great.

I was looking for “become\_flags” in [https://docs.ansible.com/ansible/2.4/intro\_configuration.html](https://docs.ansible.com/ansible/2.4/intro_configuration.html) where it doesn’t appear.  
Is that documentation out of date?

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [December 5, 2017, 9:46pm UTC](https://forum.ansible.com/t/using-sudo-with-pam-ssh-agent-auth-after-sudo-flags-is-removed/26209/4 "2017-12-05T21:46:04Z")

</div>

Yes, the state of the Ansible documentation is a mess unfortunately.  
Code is commited in without documentation, sometimes the documentation is added in a later commit but this commit is not merged in to all the correct branches.

I tried once to get a commit merged inn, but nothing happened so I guess documentation is low priority and the time is used on creating new stuff, hopefully with documentation 🙂

So the best thing is to use the latest documentation called devel since that more updated and relevant.

An there you see intro\_configuration is quite different  
[https://docs.ansible.com/ansible/devel/intro\_configuration.html](https://docs.ansible.com/ansible/devel/intro_configuration.html)