Problem: I can't figure out how to enable using the apache2 service with password-less sudo. I can enable this for all commands for the user, but as this seems like a bad idea, I want to only enable certain commands.
Background: I'm trying to setup a continuous delivery/deployment system and as part of this, I let Ansible run some commands on the target machines. Some of these commands unfortunately require sudo and I need to suppress the password prompt for these. Ideally all authorization of this process works with registered keys instead of passwords.
Configs: (Machine names have been replaced with placeholder values.)
target.example.com running Ubuntu 18.04 LTS and Apache 2.x
control.example.com running Ubuntu 16.04 LTS and Ansible 2.7.8
/etc/sudoers.d/ansible on machine
ansible ALL= NOPASSWD: /usr/sbin/service /usr/sbin/apache2 *
~/deploy.yml on machine
--- - hosts: production remote_user: ansible tasks: - name: stop apache shell: service apache2 stop become: yes become_method: sudo - name: start apache shell: service apache2 start become: yes become_method: sudo
ansible-playbook ~/deploy.yml on
control.example.com, I get an error
sudo: a password is required. I can reproduce the password prompt when logging in to the target via
ssh firstname.lastname@example.org and then running
sudo service apache2 stop and
sudo service apache2 start. Therefore I'm hesitantly claiming that the problem is somewhere with the sudo configuration on
target.example.com and Ansible is just the messenger.
I've tried different configs of
/etc/sudoers.d/ansible, mostly because I'm not certain at all about the correct syntax and tried all kinds of expressions to see what works. The only working one I found is
ansible ALL= NOPASSWD: ALL, which I want to avoid due to security concerns.