Privileged Escalation in Ansible
In Ansible, privileged escalation refers to the process of
elevating the permissions of a user or a process to gain higher
levels of access or privilege on a remote system when you are
performing any taks on managed systems. This is required when
performing certain administrative tasks that demand superuser
or administrative privileges, such as installing packages,
modifying system configurations, or managing services.
Ansible manages remote systems through SSH, and by default,
it connects using the remote user account with which Ansible
is executed means from which user you are performing tasks.
But, some tasks may require elevated privileges, and Ansible
provides several ways to achieve this:
Becoming Root with Become:
Ansible has a feature called "become" that allows you to
execute tasks as a different user, often the root user which
is a
superuser or any other user with higher privileges. You can use
the become keyword in your playbook to elevate the privilege
for specific tasks or for the entire playbook. When you use
become, Ansible will prompt for the sudo password unless
configured otherwise.
Example:
- name: Install a package with elevated privileges
become: true
hosts: Web
yum:
name: httpd
state: present
become: trueBecome Methods: Ansible have multiple "become methods" to
elevate privileges, depending on the managed system's
configuration. The most common become methods are:
become: Uses the default method for privilege escalation, which
is usually sudo.
become_user: Specifies the user account to become when
executing tasks.
become_method: Specifies the privilege escalation method,
such as sudo or su.
Example:
- name: Run a command as a different user with su
command: some_command
become: true
become_method: su
become_user: another_userPasswordless Sudo: If passwordless sudo is configured on the
remote system for the user running Ansible, you can avoid
password prompts when using become by configuring
become_ask_pass to false in your Ansible configuration file
(ansible.cfg).
Example (ansible.cfg):
ini
[defaults]
become_ask_pass = falseRemember that privilege escalation should be used with
caution, as it grants privileges control over the target
system. Always ensure that you have proper authorization
and understand the implications of the tasks you're
executing with elevated privileges.