Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:ansible_sudo_su_become_method [2025/11/11 19:42] – Jean-Baptiste
+++ tech:ansible_sudo_su_become_method [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>ansible sudo bash Wrapper CA}}
+# Ansible sudo su become method
+N'est pas autorisé
+~~~bash
+sudo -u testplop ls
+~~~
+Mais est autorisé :
+~~~bash
+sudo su - testplop
+~~~
+`/etc/sudoers.d/userc1`
+~~~bash
+User_Alias      USER_T_USERC1=userc1
+Cmnd_Alias      CMND_USERC1=/bin/su - oracle, \
+                        /bin/su - testplop
+Defaults:CMND_USERC1 !requiretty
+USER_T_USERC1     ALL= EXEC: NOPASSWD: CMND_USERC1
+~~~
+Alors que ça serait tellement plus propre de faire :
+~~~bash
+Runas_Alias RUNAS_DBA_ALL = oracle, testplop
+#USER_T_USERC1 ALL= (testplop) EXEC: NOPASSWD: ALL
+USER_T_USERC1 ALL= (RUNAS_DBA_ALL) EXEC: NOPASSWD: ALL
+~~~
+## Solution 1
+Utiliser le become plugin **community.general.sudosu**
+Pas applicable dans notre cas, et nous avons l'erreur :
+~~~
+fatal: [test-ansible]: FAILED! => {"msg": "Missing community.general.sudosu password"}
+~~~
+Car si il est possible de faire :
+~~~bash
+sudo su - testplop
+~~~
+Il n'est pas possible de faire :
+~~~bash
+sudo su -l testplop -c 'ls'
+~~~
+Il faudrait la conf sudoers suivantes :
+~~~bash
+Cmnd_Alias      CMND_USERC1=/bin/su -l oracle *, \
+                        /bin/su -l testplop *
+~~~
+Cela n'est pas sans poser des problèmes de sécurité.
+Voici la conf
+~~~bash
+ansible-galaxy collection install community.general
+~~~
+`play.yml`
+~~~yaml
+#!/usr/bin/ansible-playbook
+---
+- name: test sudosu
+  hosts: srvtest
+  gather_facts: false
+  become_method: community.general.sudosu
+  become_user: testplop
+  become: true
+  tasks:
+    - name: test
+      command: id
+      register: cmd_ls
+    - name: test
+      debug:
+        var: cmd_ls.stdout_lines
+~~~
+## Solution 2
+Source : https://github.com/ansible/ansible/issues/12686
+`/usr/local/bin/sudosu.sh`
+~~~bash
+#!/bin/bash
+#
+#sudosu.sh "user" -c "cmd"
+if [ $# -lt 3 ]; then
+    echo 'Not enough arguments: sudosu.sh "user" -c "cmd"' >&2
+    exit 1
+fi
+if [ x"-c" != x"$2" ]; then
+    echo 'Wrong 2nd arg: sudosu.sh "user" -c "cmd"' >&2
+    exit 1
+fi
+printf '%s\n' "$3" | sudo su - "$1"
+~~~
+`play.yml`
+~~~yaml
+#!/usr/bin/ansible-playbook
+---
+- name: test
+  hosts: test-ansible
+  gather_facts: false
+  become_method: su
+  # become_flags: "su -c"
+  # become_flags: "-H -S -n"   # default value
+  become_exe: /usr/local/bin/sudosu.sh
+  become_user: testplop
+  become: true
+  tasks:
+    - name: test
+      command: id
+      register: cmd_ls
+~~~
+## Autres
+~~~bash
+ansible-doc -t become -l
+~~~