1

I am trying to add new line to the /etc/sudoersfile via ansible. But it does not work what is the problem, Could you please help?

I have tried visudo -c command in order to make sudoers file to writeable.

Except from

sudo echo "test ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers

all the lines work.

These are sh files I executed, none of them worked.

 sudo adduser test
 sudo echo "******" | passwd --stdin test
 sudo cp /etc/sudoers /etc/sudoers_20180418
 sudo echo "test ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers
 sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config20180418
 sudo sed -i 's/AllowUsers/AllowUsers test/g' /etc/ssh/sshd_config

.sh file

 sudo adduser test
 sudo echo "******" | passwd --stdin test
 sudo cp /etc/sudoers /etc/sudoers_20180418
 visudo -c
 sudo echo "test ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers
 sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config20180418
 sudo sed -i 's/AllowUsers/AllowUsers test/g' /etc/ssh/sshd_config
  • Does RHEL have /etc/sudoers.d? If so consider adding a file snippet in there, instead of editing /etc/sudoers itself. – roaima Apr 18 '18 at 7:50
  • Doesn't ansible run as root? If so, using sudo is pointless and unnecessary. – roaima Apr 18 '18 at 7:53
  • 1
    When you write "none of them worked", what happened? Error messages? Files updated incorrectly? Please clarify. – roaima Apr 18 '18 at 7:55
  • 1
    actually that is the problem I just looked at the ansible logs and it says only root can execute sudoers file but the thing is ansible user have root permission and I added sudo su - command to the .sh files but it hanged – 1010111100011 Apr 18 '18 at 7:55
  • Since ansible already had root there is no point whatsoever using sudo (or su). You're also using them wrongly. I strongly suggest you remove them from your scripts. – roaima Apr 18 '18 at 8:08
1

The problem could be that the command line

sudo echo "test ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers

will redirect the output of the sudo command, using the identity of the original user to perform the redirection - and since you need root access in order to write to /etc/sudoers, this will fail. The echo command runs as root, but it does not do the redirection - this was already set up by the shell that was preparing the sudo echo ... command line for execution. And since you're using sudo here, I suspect that shell was not running as root.

You could rephrase this as:

echo "test ALL=(ALL)       NOPASSWD: ALL" | sudo tee -a /etc/sudoers >/dev/null

In this version:

  • the echo command is executed as the original user
  • the redirection to /dev/null is executed as the original user
  • but tee -a <filename> appends a copy of the piped input to the specified file as root, which is exactly what you need to happen.
  • We've ascertained that the script runs as root. – roaima Apr 18 '18 at 13:06
  • The echo command perhaps, but not necessarily the redirection. See my edit above. – telcoM Apr 18 '18 at 13:10
  • No: the script runs as root. So the sudo is unnecessary. Which unfortunately means your (otherwise correct) fix is also unnecessary. – roaima Apr 18 '18 at 13:42
  • 1
    Yes, After I remove sudo command begining of the statement it worked. – 1010111100011 Apr 19 '18 at 6:14
  • echo "test ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers – 1010111100011 Apr 19 '18 at 6:15
0

RHEL has the /etc/sudoers.d directory, the files in which are included as part of /etc/sudoers. Consider adding a file snippet in there, instead of editing /etc/sudoers itself:

echo "test ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ansible

Alternatively, you may find that Ansible has facilities for managing sudoers directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.