0

An Amazon Linux 2 machine is configured with a user that can sudo without password as follows:

# Add user
sudo groupadd -g 2002 one-username
sudo useradd -u 2002 -g 2002 -c "One Username Account" -s /bin/bash -m -d /home/one-username one-username

# Configure SSH for the user
mkdir -p /home/one-username/.ssh
cp -pr /home/ec2-user/.ssh/authorized_keys /home/one-username/.ssh/authorized_keys
chown -R one-username:one-username /home/one-username/.ssh
chmod 700 /home/one-username/.ssh
cat << 'EOF' > /etc/sudoers.d/one-username
User_Alias ONE_USERNAME = %one-username
ONE_USERNAME ALL=(ALL)      NOPASSWD: ALL
EOF
chmod 400 /etc/sudoers.d/one-username
# disable login for one-username except through ssh keys
cat << 'EOF' >> /etc/ssh/sshd_config
Match User one-username
        PasswordAuthentication no
        AuthenticationMethods publickey

EOF
# restart sshd
systemctl restart sshd

This config is preserved when an ansible playbook adds the same user to a group as follows:

 - name: Add user to different-groupname group
   command: usermod -a -G different-groupname one-username

However, when the preceding two lines are changed in the playbook to become the following 4 lines, the same user is no longer able to sudo without being prompted for a non-existent password:

 - name: Add user to different-groupname group
   user:
     name: one-username
     group: different-groupname

Why is this happening? How can Ansible's user module be re-configured here to avoid causing this problem?

Note: different-groupname group is created separately (and the one-username is added to the different-groupname separately) in the same way in both situations, and this thus not the cause of the problem here.

  • Unrelated: you can install -m 0400 /dev/stdin /etc/sudoers.d/one-username <<EOF instead of creating the file and then changing its attributes, saves repeating the filename. – Ulrich Schwarz Jun 7 at 18:34
2

Short answer

Command usermod -a ... adds the group, but the parameter group of the user module "sets the user's primary group".

Details

User one-username is created with the primary group one-username

sudo groupadd -g 2002 one-username
sudo useradd -u 2002 -g 2002 ... one-username

Members of the group one-username are allowed to sudo

User_Alias ONE_USERNAME = %one-username
ONE_USERNAME ALL=(ALL)      NOPASSWD: ALL

Ansible module user sets the primary group of the user one-username to different-groupname.

user:
  name: one-username
  group: different-groupname

Very probably members of the group different-groupname are not allowed to sudo.

Solution

Use groups instead of group parameter of the module user. Instead of

user:
  name: one-username
  group: different-groupname

use

user:
  name: one-username
  groups:
    - different-groupname

(not tested)

Additionally, the append keyword of the user module affects the set of groups for a user. If you add append: yes, the different-groupname is added to the list of groups for the user:

user:
  name: one-username
  append: yes
  groups:
    - different-groupname

By default, append defaults to no, and the user groups are set to the set of groups declared by the groups keyword. If the user belongs to other groups that are not in the groups list, the user is removed from those groups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.