0

I am trying to set up an ansible user following a tutorial. They set NOPASSWD to ALL for the ansible user, which allowed them to -become root whenever they needed with no password involved.

I tried to do the same and am long unable to get the same result. Running CentOS 8, the following lines from visudo file:

## Same thing without a password
%wheel          ALL=(ALL)       NOPASSWD: ALL
ansible         ALL=(ALL)       NOPASSWD: ALL
cloud_user      ALL=(ALL)       NOPASSWD: ALL

I'm using cloud_user for login since root login is restricted, but I still need root to install software through ansible. I surfed the internet about the order of the users in the list, but as you can see the cloud_user is the last one and is never mentioned again in the file. I assume that should allow me to use root on it without password.

The issue is that cloud_user is still prompted for password in sudo commands, and ansible says "Missing sudo password".

sudo -ll output:

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

sudo -l -U cloud_user output:

Matching Defaults entries for cloud_user on [host name]:
    !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY
    HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
    LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User cloud_user may run the following commands on [host name]:
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL

sudo cat /var/log/secure | grep cloud_user output:

Aug 27 13:23:11 localhost sshd[6222]: pam_unix(sshd:session): session opened for user cloud_user by (uid=0)
Aug 27 13:23:40 localhost sudo[6270]: cloud_user : TTY=pts/0 ; PWD=/home/cloud_user ; USER=root ; COMMAND=/bin/ls /root
Aug 27 13:23:40 localhost sudo[6270]: pam_unix(sudo:session): session opened for user root by cloud_user(uid=0)
Aug 27 13:24:03 localhost sudo[6291]: cloud_user : TTY=pts/0 ; PWD=/home/cloud_user ; USER=root ; COMMAND=/bin/cat /var/log/secure
Aug 27 13:24:03 localhost sudo[6291]: pam_unix(sudo:session): session opened for user root by cloud_user(uid=0)
17
  • What is the EUID (The Efective User ID)? Is it cloud_user ?
    – done
    Aug 25, 2021 at 12:48
  • Does cloud_user have the same uid as any other user?
    – roaima
    Aug 25, 2021 at 12:49
  • @ImHere UID and EUID are the same and are 1001. Same for other users, they increment by 1 starting 1000.
    – Telion
    Aug 25, 2021 at 12:56
  • 1
    That sudo -ll output is a little long. I was expecting only one or 2 "stanzas" to match for your user; you would need the Options: !authenticate one to be last. Do you have lots of files in /etc/sudoers.d/ ?
    – meuh
    Aug 25, 2021 at 16:16
  • 1
    Your sudo either doesn't see your files or works weirdly. Please post the output of sudo -l -U cloud_user while running it under root. Aug 26, 2021 at 13:52

1 Answer 1

2

If multiple configuration lines match to the cloud_user and the command requested, then the last line wins. The line in /etc/sudoers.d/90-cloud-init-users that matches cloud_user without NOPASSWD is overriding your line that includes the NOPASSWD.

The contents of /etc/sudoers.d are included in the main sudoers configuration at the point of the #includedir /etc/sudoers.d or @includedir /etc/sudoers.d directive (correct syntax depends on version of sudo). The ordering of the configuration lines is important: you could, in turn, use visudo -f /etc/sudoers.d/91-my-customizations to add your sudoers lines to take effect after the ones made by cloud-init.

Also, check /etc/sudo.conf for possible plug-ins or alternative configuration sources. A cloud provider may have added some customizations of their own to make sure their automation will always be able to do its jobs.

4
  • I see no solution here. Should I clean all invalid lines from 90-cloud-init-users for it to act properly?
    – Telion
    Aug 28, 2021 at 10:52
  • Since I don't see the actual contents of your 90-cloud-init-users file, but only sudo -l's interpretation of it, I cannot say for sure. But it sure looks like that file very likely contains something stupid that needs to be cleaned up. If after doing that sudo still behaves strangely, also check /etc/sudo.conf.
    – telcoM
    Aug 28, 2021 at 13:20
  • Quick question, What does the 90 in 90-cloud-init-users mean?
    – KevinZhou
    Jan 3 at 3:18
  • @KevinZhou It's probably there just to define a specific order for reading the files in the directory. Normally files in any drop-in directory are read in classic ASCII alphanumerical sort order, but prefixing a filename with a two-digit number is a common convention to make the desired order explicit. cloud-init is probably using the 90- prefix just to make sure there is plenty of free "space" both before and after it for local customizations, as you could use 00- to 89- to place your configuration before cloud-init's settings, or 91- all the way to to zz- to place it after.
    – telcoM
    Jan 3 at 5:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.