<p>I met the same situation. I have <code>login1</code> for my machine, passwordless sudo and <code>login2</code>, under which I should perform some actions. I did not solve it by ansible means. But I made such a workaround:</p>

<pre><code>- name: "Install nvm"
  shell: sudo -u buildkite-agent bash -c "&lt;my commands to be performed on behalf of buildkite-agent&gt;"
  become: true
</code></pre>

<p>Such a case:</p>

<pre><code>- name: "Install nvm"
  shell: sudo -u buildkite-agent &lt;my commands to be performed on behalf of buildkite-agent&gt;
  become: true
</code></pre>

<p>do not change home to <code>buildkite-agent</code>'s home, i.e. uses <code>/root</code> as home.</p>

CC BY-SA 4.0
2019-05-08T13:45:52.673Z
2019-05-10T00:59:40.283Z
2019-05-10T00:59:40.283Z
Dzenly
<p>Become super user at the play level and become another user at the task level:</p>

<pre><code>- hosts: all
  become: yes
  tasks:

    - file:
        path: /tmp/test
        state: touch
      become_user: www-data
</code></pre>

<p>Validation:</p>

<pre><code>$ ls -l /tmp | grep test
-rw-r--r-- 1 www-data www-data    0 Mär 10 14:08 test
</code></pre>

<p>For very simple cases, a workaround like the following could also help, but this doesn't really scale, as you cannot use ansible modules with this strategy:</p>

<pre><code>- name: test
  command: "sudo -u www-data whoami"
  become: true
</code></pre>

<p>Output (extract): <code>"stdout": "www-data"</code></p>

CC BY-SA 3.0
2018-03-12T21:37:49.617Z
I tried your first suggestion (as well as a similar thing with a `block`), but it appears Ansible overrides the commands rather than nesting them (so it essentially replaces `sudo -u root` with `sudo -u www-data`, rather than nesting them to create `sudo -u root sudo -u www-data`).  I think that manual adjustments using command/shell and careful permissioning with the files module is the only way this is possible currently in Ansible.
Xiong Chiamiov
CC BY-SA 3.0
2018-03-13T12:27:39.270Z
@XiongChiamiov, strange, that worked for me (as you can see from the `ls -l /tmp` command). I am using ansible `2.4.2.0`. But, don't you have passwordless sudo for your `ansible_user`?
Vincenzo Pii
CC BY-SA 3.0
2018-03-19T16:36:50.653Z
The ansible_user has passwordless sudo to the root account, but not to the tertiary account (`www-data` in your example).
Xiong Chiamiov
CC BY-SA 3.0
2018-03-10T13:10:18.447Z
2018-03-10T13:10:18.447Z
Vincenzo Pii
<p>What I did that worked for me :</p>
<pre><code>- name: launch pg_ctl start
  command: &quot;su &lt;USER&gt; -l -c '&lt;COMMAND&gt;'&quot;
  become: yes
  become_exe: sudo
</code></pre>
<p>PS : With <code>su -l</code>, it automatically load the <code>.bash_profile</code> and not the <code>.bashrc</code></p>

CC BY-SA 4.0
2020-06-24T09:23:50.440Z
2020-06-24T09:23:50.440Z
Thronghar
<p>For example you want to create a file you can use :</p>

<pre><code> name: Create file
 shell: "touch abc"
 become_user: &lt;username&gt;
 become: yes
</code></pre>

<p>This is equivalent to ::
sudo su username -c "touch abc"</p>

CC BY-SA 3.0
2018-03-12T16:47:28.713Z
No, it's equivalent to "sudo -u username", which as stated in the question is slightly but importantly different.
Xiong Chiamiov
CC BY-SA 3.0
2018-03-12T17:05:06.387Z
When you run the above mentioned Ansible, the file abc will be created by user mentioned in the username variable
user7155093
CC BY-SA 3.0
2018-03-12T21:33:16.107Z
Right, but you're missing the main point of the question, which is that the sudoers configuration does not allow the default ansible user to sudo directly to the final user.
Xiong Chiamiov
CC BY-SA 3.0
2018-03-10T06:50:04.133Z
2018-03-10T06:50:04.133Z
user7155093
<p>I have a server where my user is able to sudo to the root user without a password, and then the root user can sudo to a third user without a password.  However, my user cannot sudo directly to the third user without a password.</p>

<p>Ansible's <a href="https://docs.ansible.com/ansible/latest/become.html" rel="noreferrer">become</a> directive uses sudo in the traditional manner, i.e. the one that requires prompting for my password.</p>

<p>I've tried putting <code>become_user: root</code> on a block and <code>become_user: &lt;other-user&gt;</code> on a task inside that block, but it appears Ansible overrides the block's definition, rather than nesting the sudo calls as I hoped.</p>

<p>Note: this question has also been asked <a href="https://stackoverflow.com/q/47354108/120999">on StackOverflow</a>, but since there's no solution I figured I would repost it here, which I think is the better site for it.</p>

CC BY-SA 3.0
2018-03-09T02:24:26.720Z
`my user cannot sudo directly to the third user without a password` - is that under ansible or directly in the shell?
Dan Cornilescu
CC BY-SA 3.0
2018-03-12T16:46:26.770Z
@DanCornilescu In general as per sudoers configuration.
Xiong Chiamiov
CC BY-SA 3.0
2018-04-09T14:20:19.173Z
Maybe `sudo "sudo -u target_user command"` as command ?
Tensibai
CC BY-SA 4.0
2020-06-24T07:18:19.117Z
@Xiong Chiamiov, did you find a workaround that worked for you ? I have the exact same problem :(
Thronghar
<ansible>
How do you simulate "sudo su <user>" in Ansible?
Xiong Chiamiov
# How do you simulate "sudo su <user>" in Ansible?

(Asked by: username_0 on 2018-03-09)

I have a server where my user is able to sudo to the root user without a password, and then the root user can sudo to a third user without a password. However, my user cannot sudo directly to the third user without a password.

Ansible's [become](https://docs.ansible.com/ansible/latest/become.html) directive uses sudo in the traditional manner, i.e. the one that requires prompting for my password.

I've tried putting `become_user: root` on a block and `become_user:`  on a task inside that block, but it appears Ansible overrides the block's definition, rather than nesting the sudo calls as I hoped.

Note: this question has also been asked [on StackOverflow](https://stackoverflow.com/q/47354108/120999), but since there's no solution I figured I would repost it here, which I think is the better site for it.

**Tags:** ansible

> **Comments:**
> **username_1**: `my user cannot sudo directly to the third user without a password` - is that under ansible or directly in the shell?  
> **username_0**: @DanCornilescu In general as per sudoers configuration.  
> **username_2**: Maybe `sudo "sudo -u target_user command"` as command ?  
> **username_3**: @username_0, did you find a workaround that worked for you ? I have the exact same problem :(  

---

## 4 answers

### Answer by username_4 on 2019-05-08. Score: 2

I met the same situation. I have login1 for my machine, passwordless sudo and login2, under which I should perform some actions. I did not solve it by ansible means. But I made such a workaround:
- name: "Install nvm"
  shell: sudo -u buildkite-agent bash -c ""
  become: true

Such a case:
- name: "Install nvm"
  shell: sudo -u buildkite-agent 
  become: true

do not change home to buildkite-agent's home, i.e. uses /root as home.


---

### Answer by username_5 on 2018-03-10. Score: 1

Become super user at the play level and become another user at the task level:
- hosts: all
  become: yes
  tasks:

    - file:
        path: /tmp/test
        state: touch
      become_user: www-data

Validation:
$ ls -l /tmp | grep test
-rw-r--r-- 1 www-data www-data    0 Mär 10 14:08 test

For very simple cases, a workaround like the following could also help, but this doesn't really scale, as you cannot use ansible modules with this strategy:
- name: test
  command: "sudo -u www-data whoami"
  become: true

Output (extract): "stdout": "www-data"

> **Comments:**
> **username_0**: I tried your first suggestion (as well as a similar thing with a `block`), but it appears Ansible overrides the commands rather than nesting them (so it essentially replaces `sudo -u root` with `sudo -u www-data`, rather than nesting them to create `sudo -u root sudo -u www-data`).  I think that manual adjustments using command/shell and careful permissioning with the files module is the only way this is possible currently in Ansible.  
> **username_5**: @XiongChiamiov, strange, that worked for me (as you can see from the `ls -l /tmp` command). I am using ansible `2.4.2.0`. But, don't you have passwordless sudo for your `ansible_user`?  
> **username_0**: The ansible_user has passwordless sudo to the root account, but not to the tertiary account (`www-data` in your example).  

---

### Answer by username_3 on 2020-06-24. Score: 0

What I did that worked for me :
- name: launch pg_ctl start
  command: "su  -l -c ''"
  become: yes
  become_exe: sudo

PS : With su -l, it automatically load the .bash_profile and not the .bashrc


---

### Answer by username_6 on 2018-03-10. Score: -1

For example you want to create a file you can use :
 name: Create file
 shell: "touch abc"
 become_user: 
 become: yes

This is equivalent to ::
sudo su username -c "touch abc"

> **Comments:**
> **username_0**: No, it's equivalent to "sudo -u username", which as stated in the question is slightly but importantly different.  
> **username_6**: When you run the above mentioned Ansible, the file abc will be created by user mentioned in the username variable  
> **username_0**: Right, but you're missing the main point of the question, which is that the sudoers configuration does not allow the default ansible user to sudo directly to the final user.  

---

