Home / server / Questions / 887871
In Process
badbishop
Asked: 2017-12-14 01:48:25 +0800 CST

Ansible: become twice

  • 772

I'd like to run ansible such that:

  • remote user is 'normal' user

  • ... who becomes root via sudo to run a bunch of tasks

  • ... who 'becomes postgres user via su - postgres, from root, to create a PostgreSQL database.

This is typical procedure for PostgreSQL world: a special user accessible only via su from root.

Specifying become-ish parameters in a play works only when connecting as root, as the CLI options override whatever is defined in a play.

Are there more elegant ways to achieve this other than adding sudo rules or running

command: /usr/bin/su - postgres -c '/bin/createuser -D -R -S myuser

from ansible, telling it to shut the warnings up?

postgresql

1 Answers

  1. Why would you have to change effective users twice?

    You can specify the effective user ID that ansible needs to run as per task, so when you need to run a command as the postgres user, set that directly.

    tasks:
  - name: Create Postgres User
    shell: /bin/createuser -D -R -S myuser
    become: yes
    become_user: postgres

    Frequently when a user gets sudo permissions to become root they already get ALL and become any user, including postgres.

    Alternative, create an additional sudo permission such that your ansible user can execute (specific) commands as the postgres user.

    Note: Consider using the Ansible Postgres database modules to manage your databases, roles and permissions.

    In response to your comment: I connect with Ansible as a regular user:

    ansible example -a "/bin/whoami"
example | SUCCESS | rc=0 >>
hbruijn

    I have a fairly typical "/etc/sudoers.d/hbruijn" snippet that doesn't place any restrictions on what I (my Ansible user) can do: 

    # /etc/sudoers.d/hbruijn
hbruijn  ALL = NOPASSWD: ALL

    And then I can become any user to execute commands under a different user ID and task without calling on sudo or su first:

    ansible example -b --become-user=root  -a "/bin/whoami"
example | SUCCESS | rc=0 >>
root

    or:

    ansible example -b --become-user=postgres  -a "/bin/whoami"
example | SUCCESS | rc=0 >>
postgres

    all without Ansible connecting directly as the superuser.

    • 5