I am trying to set up an ansible user following a tutorial. They set NOPASSWD to ALL for the ansible user, which allowed them to -become
root whenever they needed with no password involved.
I tried to do the same and am long unable to get the same result. Running CentOS 8, the following lines from visudo file:
## Same thing without a password
%wheel ALL=(ALL) NOPASSWD: ALL
ansible ALL=(ALL) NOPASSWD: ALL
cloud_user ALL=(ALL) NOPASSWD: ALL
I'm using cloud_user for login since root login is restricted, but I still need root to install software through ansible. I surfed the internet about the order of the users in the list, but as you can see the cloud_user is the last one and is never mentioned again in the file. I assume that should allow me to use root on it without password.
The issue is that cloud_user is still prompted for password in sudo commands, and ansible says "Missing sudo password".
sudo -ll
output:
Sudoers entry:
RunAsUsers: ALL
Options: !authenticate
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Options: !authenticate
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Options: !authenticate
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
sudo -l -U cloud_user
output:
Matching Defaults entries for cloud_user on [host name]:
!visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY
HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User cloud_user may run the following commands on [host name]:
(ALL) NOPASSWD: ALL
(ALL) NOPASSWD: ALL
(ALL) NOPASSWD: ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
(ALL) ALL
sudo cat /var/log/secure | grep cloud_user
output:
Aug 27 13:23:11 localhost sshd[6222]: pam_unix(sshd:session): session opened for user cloud_user by (uid=0)
Aug 27 13:23:40 localhost sudo[6270]: cloud_user : TTY=pts/0 ; PWD=/home/cloud_user ; USER=root ; COMMAND=/bin/ls /root
Aug 27 13:23:40 localhost sudo[6270]: pam_unix(sudo:session): session opened for user root by cloud_user(uid=0)
Aug 27 13:24:03 localhost sudo[6291]: cloud_user : TTY=pts/0 ; PWD=/home/cloud_user ; USER=root ; COMMAND=/bin/cat /var/log/secure
Aug 27 13:24:03 localhost sudo[6291]: pam_unix(sudo:session): session opened for user root by cloud_user(uid=0)
cloud_user
?cloud_user
have the same uid as any other user?sudo -ll
output is a little long. I was expecting only one or 2 "stanzas" to match for your user; you would need theOptions: !authenticate
one to be last. Do you have lots of files in/etc/sudoers.d/
?sudo -l -U cloud_user
while running it under root.