Another sudo issue

[Cameron Junge]

Hi All,

Just getting started with Ansible and I'm having issues with some of the sudo stuff.

I have a user deployer, who has limited permissions on the server. Neither deployer nor root have a password set, I'm using ssh keys for deployer.

I am trying to give deployer permission to stop/start services on the server, and have tried to give them access in sudoers:

deployer ALL=(root) NOPASSWD: /usr/sbin/service

In my playbook I have a task:

tasks:
  - name: Stop Nginx
    sudo: yes
    service:
      name: nginx
      state: stopped

From what I can see, the "sudo: yes" causes the script to be wrapped in an Ansible sudo call, which uses /bin/sh to run the generated script. As the user doesn't have permission to run /bin/sh as root the result is the play locking up waiting for a password to be entered.

<server> ESTABLISH CONNECTION FOR USER: deployer
<server> REMOTE_MODULE service name=nginx state=stopped
<server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', 'ConnectTimeout=10', 'server', "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && echo $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072'"]
<server> PUT /tmp/tmpzh6oFh TO /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service
<server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', 'ConnectTimeout=10', 'server', u'/bin/sh -c \'sudo -k && sudo -H -S -p "[sudo via ansible, key=xqpamkcjagkzzsxuwdwnijqkrpitvqyy] password: " -u root /bin/sh -c \'"\'"\'echo SUDO-SUCCESS-xqpamkcjagkzzsxuwdwnijqkrpitvqyy; LC_CTYPE=C LANG=C /usr/bin/python /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service\'"\'"\'\'']

I could set the user to have permission to run /bin/sh, but that seems incorrect (may as well set it to ALL, which btw does work as I desire).

Is this something that I can resolve either in sudoers, or in the Ansible script?

Any help would be appreciated.

Cheers, Cameron

[Michael DeHaan]

Do I infer correctly that you have your sudo environment locked down so users can only run specific commands?  If so, that won't be compatible.

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To post to this group, send email to ansible...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Cameron Junge]

Yes that's correct, or at least that was the intention.

I was hoping to be able to restrict sudo to just be able to run eg. sudo service nginx restart, but by using /bin/sh to wrap the call it breaks that intention.

So I take it that there is no way to use ansible to call a command via sudo without ansible using /bin/sh? (ignoring that I could use shell: sudo service nginx restart).

if there is no way of doing this, maybe the docs should be updated to reflect this?

Cheers, Cameron

[Michael DeHaan]

Ansible can pick an executable but you can not arbitrary confine sudo since it runs lots of ansible modules not simple shell commands.

I believe the docs already discuss it to the proper depth.

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/3085ef84-2877-495f-bca6-c7eba13010ab%40googlegroups.com.