Yes that's correct, or at least that was the intention. I was hoping to be able to restrict sudo to just be able to run eg. sudo service nginx restart, but by using /bin/sh to wrap the call it breaks that intention.
So I take it that there is no way to use ansible to call a command via sudo without ansible using /bin/sh? (ignoring that I could use shell: sudo service nginx restart). if there is no way of doing this, maybe the docs should be updated to reflect this? Cheers, Cameron On Monday, 16 June 2014 13:28:25 UTC+12, Michael DeHaan wrote: > > Do I infer correctly that you have your sudo environment locked down so > users can only run specific commands? If so, that won't be compatible. > > > > > On Sun, Jun 15, 2014 at 7:15 PM, Cameron Junge <[email protected] > <javascript:>> wrote: > >> Hi All, >> >> Just getting started with Ansible and I'm having issues with some of the >> sudo stuff. >> >> I have a user deployer, who has limited permissions on the server. >> Neither deployer nor root have a password set, I'm using ssh keys for >> deployer. >> >> I am trying to give deployer permission to stop/start services on the >> server, and have tried to give them access in sudoers: >> >> deployer ALL=(root) NOPASSWD: /usr/sbin/service >> >> In my playbook I have a task: >> >> tasks: >> - name: Stop Nginx >> sudo: yes >> service: >> name: nginx >> state: stopped >> >> From what I can see, the "sudo: yes" causes the script to be wrapped in >> an Ansible sudo call, which uses /bin/sh to run the generated script. As >> the user doesn't have permission to run /bin/sh as root the result is the >> play locking up waiting for a password to be entered. >> >> <server> ESTABLISH CONNECTION FOR USER: deployer >> <server> REMOTE_MODULE service name=nginx state=stopped >> <server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', >> '-o', 'ControlPersist=60s', '-o', >> 'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', >> 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', >> 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', >> '-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', >> 'ConnectTimeout=10', 'server', "/bin/sh -c 'mkdir -p >> $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && chmod a+rx >> $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && echo >> $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072'"] >> <server> PUT /tmp/tmpzh6oFh TO >> /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service >> <server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', >> '-o', 'ControlPersist=60s', '-o', >> 'ControlPath=/home/cameron/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', >> 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', >> 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', >> '-o', 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', >> 'ConnectTimeout=10', 'server', u'/bin/sh -c \'sudo -k && sudo -H -S -p >> "[sudo via ansible, key=xqpamkcjagkzzsxuwdwnijqkrpitvqyy] password: " -u >> root /bin/sh -c \'"\'"\'echo SUDO-SUCCESS-xqpamkcjagkzzsxuwdwnijqkrpitvqyy; >> LC_CTYPE=C LANG=C /usr/bin/python >> /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072/service\'"\'"\'\''] >> >> I could set the user to have permission to run /bin/sh, but that seems >> incorrect (may as well set it to ALL, which btw does work as I desire). >> >> Is this something that I can resolve either in sudoers, or in the Ansible >> script? >> >> Any help would be appreciated. >> >> Cheers, Cameron >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Ansible Project" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To post to this group, send email to [email protected] >> <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com >> >> <https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> For more options, visit https://groups.google.com/d/optout. >> > > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/3085ef84-2877-495f-bca6-c7eba13010ab%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
