An Amazon Linux 2 machine is configured with a user that can sudo without password as follows:
# Add user sudo groupadd -g 2002 one-username sudo useradd -u 2002 -g 2002 -c "One Username Account" -s /bin/bash -m -d /home/one-username one-username # Configure SSH for the user mkdir -p /home/one-username/.ssh cp -pr /home/ec2-user/.ssh/authorized_keys /home/one-username/.ssh/authorized_keys chown -R one-username:one-username /home/one-username/.ssh chmod 700 /home/one-username/.ssh cat << 'EOF' > /etc/sudoers.d/one-username User_Alias ONE_USERNAME = %one-username ONE_USERNAME ALL=(ALL) NOPASSWD: ALL EOF chmod 400 /etc/sudoers.d/one-username # disable login for one-username except through ssh keys cat << 'EOF' >> /etc/ssh/sshd_config Match User one-username PasswordAuthentication no AuthenticationMethods publickey EOF # restart sshd systemctl restart sshd
This config is preserved when an ansible playbook adds the same user to a group as follows:
- name: Add user to different-groupname group command: usermod -a -G different-groupname one-username
However, when the preceding two lines are changed in the playbook to become the following 4 lines, the same user is no longer able to sudo without being prompted for a non-existent password:
- name: Add user to different-groupname group user: name: one-username group: different-groupname
Why is this happening? How can Ansible's user module be re-configured here to avoid causing this problem?
different-groupname group is created separately (and the
one-username is added to the
different-groupname separately) in the same way in both situations, and this thus not the cause of the problem here.