Michael, Sure! The goal is to be able to separate the user than connects to the server from the user that runs privileged commands (even if using sudo). If ssh user is different than sudo user, does it imply that sudo commands will be executed as sudo --user?
On Friday, September 26, 2014 2:40:13 PM UTC+2, Michael DeHaan wrote: > > I'm sorry, I'm having some difficulty processing the sentences above. > > The phrase "priveledge escalation" usually refers to a security > vulnerability. > > Are you having specific problems with su or sudo support in Ansible, and > if so, can you share more details about your playbook and what "isn't > working" means to you? > > I have a hard time understandingwhat "isn't working" means. > > Thanks! > > On Thu, Sep 25, 2014 at 11:35 AM, Andreas Calvo <[email protected] > <javascript:>> wrote: > >> Hi, >> To manage a large farm of servers while maintaining security we do not >> provide a privileged-enable user by SSH, but want to have a non-ssh user to >> perform sudo operations. >> However, while adopting Ansible, we have not been able to acomplish this >> privilege escalation. >> >> Sudo and su are mutual exclusive, but running sudo with a different user >> as the ssh user isn't working, as the SSH user is the one performing the >> sudo operation (at the end it executes sudo -u right?). >> >> What privilege escalation are you using on your farms? >> SSH and the same user has sudo privileges? >> >> Thanks >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Ansible Project" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To post to this group, send email to [email protected] >> <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/ansible-project/4211173a-6769-4c62-8ae8-9124d8aa1530%40googlegroups.com >> >> <https://groups.google.com/d/msgid/ansible-project/4211173a-6769-4c62-8ae8-9124d8aa1530%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> For more options, visit https://groups.google.com/d/optout. >> > > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/eeb15300-cedf-4e31-b0c8-b62600e9e95f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
