{"id":1389,"date":"2024-06-14T04:24:33","date_gmt":"2024-06-14T04:24:33","guid":{"rendered":"http:\/\/shijuvarghese.com\/?p=1389"},"modified":"2025-05-24T03:15:57","modified_gmt":"2025-05-24T03:15:57","slug":"ansible-running-jobs-as-a-specific-user","status":"publish","type":"post","link":"http:\/\/shijuvarghese.com\/?p=1389","title":{"rendered":"Ansible : Running jobs as a specific user"},"content":{"rendered":"<p>Though ansible server will run jobs in managed nodes as a root user, we can specify the user account using which the jobs should get executed in the remote nodes. This is done using the <strong>remote_user <\/strong>and\u00a0<strong>become_user\u00a0<\/strong>parameters.<\/p>\n<p>There is a major difference between the two parameters:<\/p>\n<ul>\n<li><strong>remote_user:<\/strong> When this parameter is used in a playbook, the ansible will try to access the remote node as the specified user instead or root. Here is the remote_user is &#8220;user1&#8221;, then the control node should be able to ssh to managed node via &#8220;user1&#8221;<\/li>\n<li><strong>become_user:<\/strong> Here the ansible control node will access the managed node (via ssh) as &#8220;root&#8221; (by default) and once connected, will run commands as a specified user.<\/li>\n<\/ul>\n<p>In the below playbook, we are going to create a playbook that calls two other playbooks. The main playbook called &#8220;<em>master_pb.yml<\/em>&#8221; will first call a playbook called &#8220;<em>create_user.yml<\/em>&#8221; which creates a user named &#8220;user1&#8221; and then the second playbook named &#8220;<em>create_file.yml<\/em>&#8221; will crate a file using the user &#8220;user1&#8221;.<\/p>\n<p>In the managed node is &#8220;centosMYOBvm&#8221; let us check if the user &#8220;user1&#8221; exists, and if any file is present in the user&#8217;s home directory:<\/p>\n<p><strong>[root@centosMYOBvm ~]#<\/strong> ls -ltr \/home\/user1\/<br \/>\n<em>ls: cannot access &#8216;\/home\/user1\/&#8217;: No such file or directory<\/em><\/p>\n<p>==== ====<\/p>\n<p>Let us create the two playbooks now<\/p>\n<p><strong>[root@centos9vm ~]#<\/strong> cat create_user.yml<\/p>\n<p>==== ===<br \/>\n&#8211; &#8211; &#8211;<br \/>\n<em>&#8211; name: Playbook to create a user names user1<\/em><br \/>\n<em> &nbsp; &nbsp; hosts: testONE<\/em><br \/>\n<em> &nbsp; &nbsp; tasks:<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &#8211; name: A task to create a new user<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ansible.builtin.user:<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name: user1<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; comment: User 1<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; groups: webadmin<\/em><\/p>\n<p>==== ===<\/p>\n<p><strong>[root@centos9vm ~]#<\/strong> cat create_file.yml<\/p>\n<p>==== ==<br \/>\n<em>&#8211; &#8211; &#8211;<\/em><br \/>\n<em>&#8211; name: Playbook to create a file using user1<\/em><br \/>\n<em> &nbsp; &nbsp; hosts: testONE<\/em><br \/>\n<span style=\"color: #ff6600;\"><em> &nbsp; &nbsp; become_user: user1<\/em><\/span><br \/>\n<span style=\"color: #ff6600;\"><em> &nbsp; &nbsp; become: true<\/em><\/span><br \/>\n<em> &nbsp; &nbsp; tasks:<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &#8211; name: Create a file<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ansible.builtin.file:<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name: \/home\/user1\/tom.txt<\/em><br \/>\n<em> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; state: touch<\/em><\/p>\n<p>==== ===<\/p>\n<p>Now let us create the master playbook.<\/p>\n<p><strong>[root@centos9vm ~]#<\/strong> cat master_pb.yml<\/p>\n<p>===== ===<br \/>\n<em>&#8211; &#8211; &#8211;<\/em><br \/>\n<em>&#8211; name: Import the playbook create_user.yml<\/em><br \/>\n<em> &nbsp; &nbsp; import_playbook: create_user.yml<\/em><\/p>\n<p><em>&#8211; name: Import the playbook create_file.yml<\/em><br \/>\n<em> &nbsp; &nbsp; import_playbook: create_file.yml<\/em><\/p>\n<p>==== ===<\/p>\n<p>Let us execute the playbook<\/p>\n<p><strong>[root@centos9vm ~]#<\/strong> ansible-navigator run -m stdout master_pb.yml<\/p>\n<p>=== ===<\/p>\n<p><em>PLAY [Playbook to create a user names user1] ***********************************<\/em><\/p>\n<p><em>TASK [Gathering Facts] *********************************************************<\/em><br \/>\n<em>ok: [192.168.48.129]<\/em><\/p>\n<p><em>TASK [A task to create a new user] *********************************************<\/em><br \/>\n<em>ok: [192.168.48.129]<\/em><\/p>\n<p><em>PLAY [Playbook to create a file using user1] ***********************************<\/em><\/p>\n<p><em>TASK [Gathering Facts] *********************************************************<\/em><br \/>\n<em>[WARNING]: Module remote_tmp \/home\/user1\/.ansible\/tmp did not exist and was<\/em><br \/>\n<em>created with a mode of 0700, this may cause issues when running as another<\/em><br \/>\n<em>user. To avoid this, create the remote_tmp dir with the correct permissions<\/em><br \/>\n<em>manually<\/em><br \/>\n<em>ok: [192.168.48.129]<\/em><\/p>\n<p><em>TASK [Create a file] ***********************************************************<\/em><br \/>\n<em>changed: [192.168.48.129]<\/em><\/p>\n<p><em>PLAY RECAP *********************************************************************<\/em><br \/>\n<em>192.168.48.129 : ok=4 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0<\/em><\/p>\n<p>=== ===<\/p>\n<p>As the playbook executed successfully, let us verify the file that is created and the owner of that file.<\/p>\n<p><strong>[root@centosMYOBvm ~]#<\/strong> ls -ltr \/home\/user1\/<br \/>\n<em>total 0<\/em><br \/>\n<em>-rw-r&#8211;r&#8211;. 1 <span style=\"color: #ff6600;\"><strong>user1<\/strong><\/span> user1 0 Jun 14 11:42 tom.txt<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>Though ansible server will run jobs in managed nodes as a root user, we can specify the user account using which the jobs should get <a class=\"mh-excerpt-more\" href=\"http:\/\/shijuvarghese.com\/?p=1389\" title=\"Ansible : Running jobs as a specific user\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":1792,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32,21,3],"tags":[],"class_list":["post-1389","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ansible","category-devops","category-linux"],"_links":{"self":[{"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/posts\/1389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1389"}],"version-history":[{"count":12,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/posts\/1389\/revisions"}],"predecessor-version":[{"id":1402,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/posts\/1389\/revisions\/1402"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=\/wp\/v2\/media\/1792"}],"wp:attachment":[{"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1389"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/shijuvarghese.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}