Answers: <p>I met the same situation. I have <code>login1</code> for my machine, passwordless sudo and <code>login2</code>, under which I should perform some actions. I did not solve it by ansible means. But I made such a workaround:</p>
  
  <pre><code>- name: "Install nvm"
    shell: sudo -u buildkite-agent bash -c "&lt;my commands to be performed on behalf of buildkite-agent&gt;"
    become: true
  </code></pre>
  
  <p>Such a case:</p>
  
  <pre><code>- name: "Install nvm"
    shell: sudo -u buildkite-agent &lt;my commands to be performed on behalf of buildkite-agent&gt;
    become: true
  </code></pre>
  
  <p>do not change home to <code>buildkite-agent</code>'s home, i.e. uses <code>/root</code> as home.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-05-08T13:45:52.673Z
Answers: 2019-05-10T00:59:40.283Z
Answers: 2019-05-10T00:59:40.283Z
Answers: Dzenly
Answers: <p>Become super user at the play level and become another user at the task level:</p>
  
  <pre><code>- hosts: all
    become: yes
    tasks:
  
      - file:
          path: /tmp/test
          state: touch
        become_user: www-data
  </code></pre>
  
  <p>Validation:</p>
  
  <pre><code>$ ls -l /tmp | grep test
  -rw-r--r-- 1 www-data www-data    0 Mär 10 14:08 test
  </code></pre>
  
  <p>For very simple cases, a workaround like the following could also help, but this doesn't really scale, as you cannot use ansible modules with this strategy:</p>
  
  <pre><code>- name: test
    command: "sudo -u www-data whoami"
    become: true
  </code></pre>
  
  <p>Output (extract): <code>"stdout": "www-data"</code></p>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-12T21:37:49.617Z
Answers: I tried your first suggestion (as well as a similar thing with a `block`), but it appears Ansible overrides the commands rather than nesting them (so it essentially replaces `sudo -u root` with `sudo -u www-data`, rather than nesting them to create `sudo -u root sudo -u www-data`).  I think that manual adjustments using command/shell and careful permissioning with the files module is the only way this is possible currently in Ansible.
Answers: Xiong Chiamiov
Answers: CC BY-SA 3.0
Answers: 2018-03-13T12:27:39.270Z
Answers: @XiongChiamiov, strange, that worked for me (as you can see from the `ls -l /tmp` command). I am using ansible `2.4.2.0`. But, don't you have passwordless sudo for your `ansible_user`?
Answers: Vincenzo Pii
Answers: CC BY-SA 3.0
Answers: 2018-03-19T16:36:50.653Z
Answers: The ansible_user has passwordless sudo to the root account, but not to the tertiary account (`www-data` in your example).
Answers: Xiong Chiamiov
Answers: CC BY-SA 3.0
Answers: 2018-03-10T13:10:18.447Z
Answers: 2018-03-10T13:10:18.447Z
Answers: Vincenzo Pii
Answers: <p>What I did that worked for me :</p>
  <pre><code>- name: launch pg_ctl start
    command: &quot;su &lt;USER&gt; -l -c '&lt;COMMAND&gt;'&quot;
    become: yes
    become_exe: sudo
  </code></pre>
  <p>PS : With <code>su -l</code>, it automatically load the <code>.bash_profile</code> and not the <code>.bashrc</code></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-06-24T09:23:50.440Z
Answers: 2020-06-24T09:23:50.440Z
Answers: Thronghar
Answers: <p>For example you want to create a file you can use :</p>
  
  <pre><code> name: Create file
   shell: "touch abc"
   become_user: &lt;username&gt;
   become: yes
  </code></pre>
  
  <p>This is equivalent to ::
  sudo su username -c "touch abc"</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-12T16:47:28.713Z
Answers: No, it's equivalent to "sudo -u username", which as stated in the question is slightly but importantly different.
Answers: Xiong Chiamiov
Answers: CC BY-SA 3.0
Answers: 2018-03-12T17:05:06.387Z
Answers: When you run the above mentioned Ansible, the file abc will be created by user mentioned in the username variable
Answers: user7155093
Answers: CC BY-SA 3.0
Answers: 2018-03-12T21:33:16.107Z
Answers: Right, but you're missing the main point of the question, which is that the sudoers configuration does not allow the default ansible user to sudo directly to the final user.
Answers: Xiong Chiamiov
Answers: CC BY-SA 3.0
Answers: 2018-03-10T06:50:04.133Z
Answers: 2018-03-10T06:50:04.133Z
Answers: user7155093
Body: <p>I have a server where my user is able to sudo to the root user without a password, and then the root user can sudo to a third user without a password.  However, my user cannot sudo directly to the third user without a password.</p>
  
  <p>Ansible's <a href="https://docs.ansible.com/ansible/latest/become.html" rel="noreferrer">become</a> directive uses sudo in the traditional manner, i.e. the one that requires prompting for my password.</p>
  
  <p>I've tried putting <code>become_user: root</code> on a block and <code>become_user: &lt;other-user&gt;</code> on a task inside that block, but it appears Ansible overrides the block's definition, rather than nesting the sudo calls as I hoped.</p>
  
  <p>Note: this question has also been asked <a href="https://stackoverflow.com/q/47354108/120999">on StackOverflow</a>, but since there's no solution I figured I would repost it here, which I think is the better site for it.</p>
  
Comments: CC BY-SA 3.0
Comments: 2018-03-09T02:24:26.720Z
Comments: `my user cannot sudo directly to the third user without a password` - is that under ansible or directly in the shell?
Comments: Dan Cornilescu
Comments: CC BY-SA 3.0
Comments: 2018-03-12T16:46:26.770Z
Comments: @DanCornilescu In general as per sudoers configuration.
Comments: Xiong Chiamiov
Comments: CC BY-SA 3.0
Comments: 2018-04-09T14:20:19.173Z
Comments: Maybe `sudo "sudo -u target_user command"` as command ?
Comments: Tensibai
Comments: CC BY-SA 4.0
Comments: 2020-06-24T07:18:19.117Z
Comments: @Xiong Chiamiov, did you find a workaround that worked for you ? I have the exact same problem :(
Comments: Thronghar
Tags: <ansible>
Title: How do you simulate "sudo su <user>" in Ansible?
UserDisplayName: Xiong Chiamiov
ThreadText: # How do you simulate "sudo su <user>" in Ansible?
  
  (Asked by: username_0 on 2018-03-09)
  
  I have a server where my user is able to sudo to the root user without a password, and then the root user can sudo to a third user without a password. However, my user cannot sudo directly to the third user without a password.
  
  Ansible's [become](https://docs.ansible.com/ansible/latest/become.html) directive uses sudo in the traditional manner, i.e. the one that requires prompting for my password.
  
  I've tried putting `become_user: root` on a block and `become_user: <other-user>` on a task inside that block, but it appears Ansible overrides the block's definition, rather than nesting the sudo calls as I hoped.
  
  Note: this question has also been asked [on StackOverflow](https://stackoverflow.com/q/47354108/120999), but since there's no solution I figured I would repost it here, which I think is the better site for it.
  
  **Tags:** ansible
  
  > **Comments:**
  > **username_1**: `my user cannot sudo directly to the third user without a password` - is that under ansible or directly in the shell?  
  > **username_0**: @username_1 In general as per sudoers configuration.  
  > **username_2**: Maybe `sudo "sudo -u target_user command"` as command ?  
  > **username_3**: @username_0, did you find a workaround that worked for you ? I have the exact same problem :(  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_4 on 2019-05-08. Score: 2
  
  I met the same situation. I have `login1` for my machine, passwordless sudo and `login2`, under which I should perform some actions. I did not solve it by ansible means. But I made such a workaround:
  
  ```
  - name: "Install nvm"
    shell: sudo -u buildkite-agent bash -c "<my commands to be performed on behalf of buildkite-agent>"
    become: true
  
  ```
  
  Such a case:
  
  ```
  - name: "Install nvm"
    shell: sudo -u buildkite-agent <my commands to be performed on behalf of buildkite-agent>
    become: true
  
  ```
  
  do not change home to `buildkite-agent`'s home, i.e. uses `/root` as home.
  
  
  ---
  
  ### Answer by username_5 on 2018-03-10. Score: 1
  
  Become super user at the play level and become another user at the task level:
  
  ```
  - hosts: all
    become: yes
    tasks:
  
      - file:
          path: /tmp/test
          state: touch
        become_user: www-data
  
  ```
  
  Validation:
  
  ```
  $ ls -l /tmp | grep test
  -rw-r--r-- 1 www-data www-data    0 Mär 10 14:08 test
  
  ```
  
  For very simple cases, a workaround like the following could also help, but this doesn't really scale, as you cannot use ansible modules with this strategy:
  
  ```
  - name: test
    command: "sudo -u www-data whoami"
    become: true
  
  ```
  
  Output (extract): `"stdout": "www-data"`
  
  > **Comments:**
  > **username_0**: I tried your first suggestion (as well as a similar thing with a `block`), but it appears Ansible overrides the commands rather than nesting them (so it essentially replaces `sudo -u root` with `sudo -u www-data`, rather than nesting them to create `sudo -u root sudo -u www-data`).  I think that manual adjustments using command/shell and careful permissioning with the files module is the only way this is possible currently in Ansible.  
  > **username_5**: @username_0, strange, that worked for me (as you can see from the `ls -l /tmp` command). I am using ansible `2.4.2.0`. But, don't you have passwordless sudo for your `ansible_user`?  
  > **username_0**: The ansible_user has passwordless sudo to the root account, but not to the tertiary account (`www-data` in your example).  
  
  ---
  
  ### Answer by username_3 on 2020-06-24. Score: 0
  
  What I did that worked for me :
  
  ```
  - name: launch pg_ctl start
    command: "su <USER> -l -c '<COMMAND>'"
    become: yes
    become_exe: sudo
  
  ```
  
  PS : With `su -l`, it automatically load the `.bash_profile` and not the `.bashrc`
  
  
  ---
  
  ### Answer by username_6 on 2018-03-10. Score: -1
  
  For example you want to create a file you can use :
  
  ```
   name: Create file
   shell: "touch abc"
   become_user: <username>
   become: yes
  
  ```
  
  This is equivalent to ::
  sudo su username -c "touch abc"
  
  > **Comments:**
  > **username_0**: No, it's equivalent to "sudo -u username", which as stated in the question is slightly but importantly different.  
  > **username_6**: When you run the above mentioned Ansible, the file abc will be created by user mentioned in the username variable  
  > **username_0**: Right, but you're missing the main point of the question, which is that the sudoers configuration does not allow the default ansible user to sudo directly to the final user.  
  
  ---
  
  