预配置sudoers权限后Ansible使用yum安装包失败问题排查

使用非root用户test_user通过Ansible连接RHEL 8.9服务器，目标是让该用户安装yum包。已在sudoers文件中配置该用户可免密执行/usr/bin/yum命令，手动登录服务器执行sudo yum update正常，但Ansible执行yum安装任务时提示"Missing sudo password"错误。

已配置的sudoers规则 #

test_user ALL=(ALL) NOPASSWD: /usr/bin/yum

手动测试结果 #

[test-user@TESTHOST01~]$ sudo yum update
Updating Subscription Management repositories.
Microsoft Tools for RedHat 8                                                                                                                                                      33 kB/s | 2.0 kB     00:00
Oracle_yum_repository                                                                                                                                                             31 kB/s | 2.0 kB     00:00
Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)                                                                                                                          86 kB/s | 4.5 kB     00:00
Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)                                                                                                                             68 kB/s | 4.1 kB     00:00
DockerCE_8Server                                                                                                                                                                  40 kB/s | 2.0 kB     00:00
EPEL8_REPO                                                                                                                                                                        39 kB/s | 2.3 kB     00:00
Dependencies resolved.
Nothing to do.
Complete!

Ansible Playbook片段 #

- name: Install docker
  ansible.builtin.yum:
    name: "{{ packages }}"
    state: present
  vars:
    packages:
    - git
    - containerd.io-1.6.9-3.1.el8
    - docker-ce-cli-1:20.10.20-3.el8
    - docker-ce-rootless-extras-20.10.20-3.el8
    - docker-compose-plugin-2.12.0-3.el8
  become: true
  become_user: root
  become_method: sudo

报错信息 #

TASK [ans_rol_docker_swarm : Install docker] ***********************************
fatal: [10.5.237.14]: FAILED! => {"msg": "Missing sudo password"}
fatal: [10.5.237.10]: FAILED! => {"msg": "Missing sudo password"}
fatal: [10.5.237.15]: FAILED! => {"msg": "Missing sudo password"}

版本信息 #

Ansible版本 #

ansible [core 2.13.13]
  config file = None
  configured module search path = ['/home/runner/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.10/dist-packages/ansible
  ansible collection location = /home/runner/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0]
  jinja version = 3.1.3
  libyaml = True

服务器系统版本 #

NAME="Red Hat Enterprise Linux"
VERSION="8.9 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.9"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.9 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_BUGZILLA_PRODUCT_VERSION=8.9
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.9"

问题原因及解决方法 #

原因 #

Ansible的yum模块启用become: true时，默认会尝试切换到root用户执行整个模块的所有操作（比如先执行sudo -i切换环境），这类切换用户的命令不在配置的免密sudo规则内，因此触发密码验证报错。

解决方法 #

方法1：调整sudoers规则

修改sudoers配置，允许test_user免密执行yum及Ansible模块依赖的环境切换命令，使用visudo编辑避免语法错误：

test_user ALL=(ALL) NOPASSWD: /usr/bin/yum, /bin/sh

若信任该用户，也可临时放宽规则测试：

test_user ALL=(ALL) NOPASSWD: ALL

方法2：直接调用sudo yum命令

放弃yum模块，改用command模块直接执行sudo yum install，仅触发配置的免密yum规则：

- name: Install docker packages
  ansible.builtin.command: sudo yum install -y "{{ packages | join(' ') }}"
  vars:
    packages:
    - git
    - containerd.io-1.6.9-3.1.el8
    - docker-ce-cli-1:20.10.20-3.el8
    - docker-ce-rootless-extras-20.10.20-3.el8
    - docker-compose-plugin-2.12.0-3.el8

方法3：配置Ansible的become_flags

指定sudo仅执行yum命令，而非切换用户：

- name: Install docker
  ansible.builtin.yum:
    name: "{{ packages }}"
    state: present
  vars:
    packages:
    - git
    - containerd.io-1.6.9-3.1.el8
    - docker-ce-cli-1:20.10.20-3.el8
    - docker-ce-rootless-extras-20.10.20-3.el8
    - docker-compose-plugin-2.12.0-3.el8
  become: true
  become_method: sudo
  become_flags: "/usr/bin/yum"

内容的提问来源于stack exchange，提问作者Miklós