1

I'm trying to execute an ansible command as a user-level cron job which looks as follows:

@reboot /home/jon/.local/bin/ansible-playbook /home/jon/deactivate.yml where deactivate.yml is doing something which is going to need root privileges. Consequently I've edited my sudoers file via sudo visudo to look like this, in order to execute the command without the need to pass the sudo password:

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

jon ALL=(root) NOPASSWD: /home/jon/.local/bin/ansible-playbook /home/jon/deactivate_proxy.yml`

After adding this to the sudoers file, the user jon is able to execute the command succesfully. When doing a reboot, the cron job isnt executed succesfully. Moreover, I'm not able to execute the command itself after performing a reboot as I get warned that the sudo password is required. However, when executing another command with sudo (like sudo visudo or sudo -i) and passing the correct credentials, I'm able to execute the former command. It seems like the line I've added to the sudoers file only works after passing the sudo password at any time before executing my ansible-playbook command.

What is the reason for this behavior? What can I do to successfully execute my command after a reboot?

Edit: the user jon is part of the group sudo.

Improve this question

1 Answer 1

Reset to default
0

This is not enough

jon ALL=(root) NOPASSWD: /home/jon/.local/bin/ansible-playbook playbook.yml

Quoting from Can’t limit escalation to certain commands:

Privilege escalation permissions have to be general. ...

Fix sudoers, e.g.

jon ALL=NOPASSWD: ALL
Improve this answer
2
  • Thank you, I didnt know about the limited privilege escalation - but it makes sense. Do you have any idea, how I could perform that kind of cron job, without giving the user too many permissions? And what is the reason, that my command works after reboot when executing any random command with sudo beforehand? And why does it not work after a fresh reboot?
    – jondon987
    Mar 17, 2021 at 19:23
  • What do you mean by without giving the user too many permissions? The user must be given ALL permissions. I also don't understand how executing any random command with sudo after reboot is related to Ansible? I can't help without MRE.
    – Vladimir Botka
    Mar 17, 2021 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .