Do I infer correctly that you have your sudo environment locked down so users can only run specific commands? If so, that won't be compatible.
On Sun, Jun 15, 2014 at 7:15 PM, Cameron Junge <[email protected]> wrote: > Hi All, > > Just getting started with Ansible and I'm having issues with some of the > sudo stuff. > > I have a user deployer, who has limited permissions on the server. Neither > deployer nor root have a password set, I'm using ssh keys for deployer. > > I am trying to give deployer permission to stop/start services on the > server, and have tried to give them access in sudoers: > > deployer ALL=(root) NOPASSWD: /usr/sbin/service > > In my playbook I have a task: > > tasks: > - name: Stop Nginx > sudo: yes > service: > name: nginx > state: stopped > > From what I can see, the "sudo: yes" causes the script to be wrapped in an > Ansible sudo call, which uses /bin/sh to run the generated script. As the > user doesn't have permission to run /bin/sh as root the result is the play > locking up waiting for a password to be entered. > > <server> ESTABLISH CONNECTION FOR USER: deployer > <server> REMOTE_MODULE service name=nginx state=stopped > <server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', > '-o', 'ControlPersist=60s', '-o', > 'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', > 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', > 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', > '-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', > 'ConnectTimeout=10', 'server', "/bin/sh -c 'mkdir -p > $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && chmod a+rx > $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && echo > $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072'"] > <server> PUT /tmp/tmpzh6oFh TO > /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service > <server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', > '-o', 'ControlPersist=60s', '-o', > 'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', > 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', > 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', > '-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', > 'ConnectTimeout=10', 'server', u'/bin/sh -c \'sudo -k && sudo -H -S -p > "[sudo via ansible, key=xqpamkcjagkzzsxuwdwnijqkrpitvqyy] password: " -u > root /bin/sh -c \'"\'"\'echo SUDO-SUCCESS-xqpamkcjagkzzsxuwdwnijqkrpitvqyy; > LC_CTYPE=C LANG=C /usr/bin/python > /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service\'"\'"\'\''] > > I could set the user to have permission to run /bin/sh, but that seems > incorrect (may as well set it to ALL, which btw does work as I desire). > > Is this something that I can resolve either in sudoers, or in the Ansible > script? > > Any help would be appreciated. > > Cheers, Cameron > > -- > You received this message because you are subscribed to the Google Groups > "Ansible Project" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com > <https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CA%2BnsWgwhwds6yQ6b%2ByPj7nrMx2QUBPMD56nUbMkJisQa-c-Pnw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
