使用堡垒机时Ansible的become提权配置未生效问题咨询
Ansible通过堡垒机连接目标服务器时become配置失效问题
我在通过堡垒机连接目标服务器时,配置了以下提权参数:
become: true become_user: root
但该配置未生效,始终以普通用户terraform登录,无法自动提权。
堡垒机连接通过环境变量配置:
"ANSIBLE_SSH_COMMON_ARGS": "-o ProxyCommand='ssh -p 22 -W %h:%p -q user@ip_obfuscated -i /home/semaphore/.ssh/jump.priv'"
执行debug时的完整连接命令如下,连接本身正常:
<ip_obfuscated> SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'IdentityFile="/tmp/semaphore/access_key_136706914"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="terraform"' -o ConnectTimeout=10 -o 'ProxyCommand=ssh -p 22 -W %h:%p -q user@ip_obfuscated -i /home/semaphore/.ssh/jump.priv' -o 'ControlPath="/tmp/semaphore/.ansible/cp/1713c02767"' ip_obfuscated '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo /home/terraform/.ansible/tmp `"&& mkdir "` echo /home/terraform/.ansible/tmp/ansible-tmp-1668542130.3374832-2167-135826106011908 `" && echo ansible-tmp-1668542130.3374832-2167-135826106011908="` echo /home/terraform/.ansible/tmp/ansible-tmp-1668542130.3374832-2167-135826106011908 `" ) && sleep 0'"'"''
测试用Playbook内容:
--- - name: Remove user from Linux server hosts: all become: true tasks: # 检查当前用户 - name: Determine current user shell: whoami register: current_user - name: Print current user debug: msg: "Current user is {{ current_user.stdout }}" # 检查sudo后的用户 - name: Determine current user after sudo shell: sudo whoami register: current_user2 - name: Print current user after sudo debug: msg: "Current user is {{ current_user2.stdout }}"
执行结果:
9:12:34 PM 9:12:34 PM TASK [Print current user] ****************************************************** 9:12:34 PM ok: [ip_obfuscated] => { 9:12:34 PM "msg": "Current user is terraform" 9:12:34 PM } 9:12:38 PM 9:12:38 PM TASK [Determine current user after sudo] *************************************** 9:12:38 PM changed: [ip_obfuscated] 9:12:38 PM 9:12:38 PM TASK [Print current user after sudo] ******************************************* 9:12:38 PM ok: [ip_obfuscated] => { 9:12:38 PM "msg": "Current user is root" 9:12:38 PM } 9:12:38 PM
我使用最新版Ansible,尝试过全局配置、任务级配置、inventory配置等多种become组合,仍无法让Ansible自动切换到root权限,请问问题原因是什么?
内容的提问来源于stack exchange,提问作者VladoPortos
相关产品推荐
相关产品推荐

