1

Problem: I can't figure out how to enable using the apache2 service with password-less sudo. I can enable this for all commands for the user, but as this seems like a bad idea, I want to only enable certain commands.

Background: I'm trying to setup a continuous delivery/deployment system and as part of this, I let Ansible run some commands on the target machines. Some of these commands unfortunately require sudo and I need to suppress the password prompt for these. Ideally all authorization of this process works with registered keys instead of passwords.

Configs: (Machine names have been replaced with placeholder values.)

Machine target.example.com running Ubuntu 18.04 LTS and Apache 2.x

Machine control.example.com running Ubuntu 16.04 LTS and Ansible 2.7.8

File /etc/sudoers.d/ansible on machine target.example.com:

ansible ALL= NOPASSWD: /usr/sbin/service /usr/sbin/apache2 *

File /etc/ansible/hostson machine control.example.com:

[production]
target.example.com

File ~/deploy.yml on machine control.example.com:

---
- hosts: production
  remote_user: ansible

  tasks:
  - name: stop apache
    shell: service apache2 stop
    become: yes
    become_method: sudo
  - name: start apache
    shell: service apache2 start
    become: yes
    become_method: sudo

Additional info: When running ansible-playbook ~/deploy.yml on control.example.com, I get an error sudo: a password is required. I can reproduce the password prompt when logging in to the target via ssh ansible@target.example.com and then running sudo service apache2 stop and sudo service apache2 start. Therefore I'm hesitantly claiming that the problem is somewhere with the sudo configuration on target.example.com and Ansible is just the messenger.

I've tried different configs of /etc/sudoers.d/ansible, mostly because I'm not certain at all about the correct syntax and tried all kinds of expressions to see what works. The only working one I found is ansible ALL= NOPASSWD: ALL, which I want to avoid due to security concerns.

1

The original question was conflating two seperate issues. It seems that it is not possible to specifcy arguments or flags for the command specification of a line in a sudoers file. Thus the command specification has to either be generalized to /usr/sbin/service, which is again insecure, or it has to be changed to enable NOPASSWD on a command that is more restrictive than allowing any service to be run with sudo.

Fortunately in this case I can simply use the apachectl service directly to allow fine-grained sudo rights for apache and nothing else. The updated file /etc/sudoers.d/ansible:

ansible ALL=(ALL) NOPASSWD: /usr/sbin/apachectl

Note that running the Ansible playbook, updated to use apachectl still fails with the error message sudo: a password is required, however this appears to be a seperate issue with how I attempt to use Ansible or possibly something else. Regardless, it does not seem relevant to the sudo issue of the original question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.