Ansible privilege escalation prompt problem

Question

---
- name: Transfer and execute a script.
  hosts: jumpbox
  remote_user: pppruser
  any_errors_fatal: true
  gather_facts: no
  become: true
  become_method: su
  become_user: splunk
  become_flags: '-s /bin/sh'
  tasks:
     - name: Transfer the script
       copy: src=test.sh dest=/home/splunk/ mode=0777
     - name: Execute the script
       command: sh /export/home/splunk/test.sh

[splunk@ansible playbooks]$ cat test.sh
#!/bin/bash
cat /etc/passwd > /tmp/test

With above main.yml script and used below playbook command

$ansible-playbook /etc/ansible/playbooks/main.yml --extra-vars "host=jumpbox" --ask-become-pass 
SUDO password:
PLAY [Transfer and execute a script.] **********************************************************************************
TASK [Transfer the script] *********************************************************************************************
fatal: [192.168.1.20]: FAILED! => {"msg": "Timeout (12s) waiting for privilege escalation prompt: "}
NO MORE HOSTS LEFT *****************************************************************************************************
        to retry, use: --limit @/etc/ansible/playbooks/main.retry
PLAY RECAP *********************************************************************************************************
192.168.1.20               : ok=0    changed=0    unreachable=0    failed=1

It is failing with error. I tried with different options and different suggestions from multiple forums. But nothing works. On the destination server(192.168.1.20) I have remote_user(pppruser) and service account(splunk). pppruser has sudo privileges to splunk. Here is the sudo list for pppruser account

$sudo -l
User pppruser may run the following commands on this host:
    (root) /bin/su - splunk
$sudo su - splunk

Can anyone suggest me where I need configuration change in order to run my playbook execution as splunk user without problem.

You cannot use become with narrowed escalation privileges (known limitation and risk) => https://docs.ansible.com/ansible/latest/user_guide/become.html#privilege-escalation-must-be-general — Zeitounator, Feb 12 '20 at 08:16

score 1 · Answer 1 · answered Feb 12 '20 at 10:13

1

you might want to look at this enter link description here

- name: Transfer and execute a script.
  hosts: jumpbox
  remote_user: pppruser
  any_errors_fatal: true
  gather_facts: no
  become: true
  become_user: splunk
  tasks:
     - name: Transfer the script
       copy: src=test.sh dest=/home/splunk/ mode=0777

     - name: Execute the script
       command: sh /export/home/splunk/test.sh

answered Feb 12 '20 at 10:13

shreyash

426
1
3
11

Thanks for you suggestion. But I was able to resolve the problem by making changes to my target server sudoers file. I will post my answer shortly. – Prithiviraj Pandurangan Feb 13 '20 at 17:09

score 1 · Answer 2 · answered Feb 17 '20 at 01:34

1

Adding below sudo privileges in my target serve fixed this problem.

pppruser ALL=(root) /bin/su - splunk pppruser ALL=(splunk) /bin/sh

answered Feb 17 '20 at 01:34

Prithiviraj Pandurangan

21
1
3

Ansible privilege escalation prompt problem

2 Answers2