Shell module breaks when becoming a user whose configured shell is /usr/sbin/nologin #26741
Comments
ansibot
added
affects_2.4
calfonso
removed
the
needs_triage
|
Hi! Thanks very much for your interest in Ansible. It sincerely means a lot to us. This appears to be a user question, and we'd like to direct these kinds of things to either the mailing list or the IRC channel. IRC: #ansible on irc.freenode.net Thank you once again and we look forward to seeing you on the list or IRC. Thanks! |
|
Hi @calfonso I don't get how I made it to appear like a user request but anyway.. I'm not asking how to make the playbook work. It does work. Using ansible 2.3.1.0 it produces the expected output. However, after the same playbook fails with the provided error. |
|
Issue updated to include -vvvv execution of the play on ansible 2.3.1.0 & fixed my /etc/hosts which made sudo print a (seemingly confusing) warning message. |
|
This seems like a legitimate regression... which I've just hit. Please consider reopening as a bug. |
|
+1 over here. I've run into this issue today when my Ubuntu received a 2.4.0.0 update, suddenly old tasks started failing. After some digging and a downgrade to 2.3.2 I've verified that this is definitely an issue with ansible version. When you word out the issue, it kinda makes sense - asking to use shell for a user that is not supposed to have shell, is somewhat backwards (even if it used to work, not necessarily it should). Workaround: |
|
@calfonso would you mind reopening this issue, as it appears as a valid regression, or please provide an explanation of why this is not going to be changed? Cheers! |
|
I believe the problem here is with the shell module documentation (https://docs.ansible.com/ansible/latest/shell_module.html), which says: Given that, I think the correct way to handle the OP example would be: I think this is a documentation bug. The shell module documentation should be updated to make it clear that the user's |
Ansible v2.4.0 uses the `become_user` default shell or `$SHELL`
environment variable which is a problem if the `become_user` has
`/usr/sbin/nologin` or `/bin/false` as their default shell. (The
default shell can be found in `/etc/passwd`)
The error when running the main playbook:
```
TASK [zope_common : run bootstrap]
*******************************************************************************************************************************************
fatal: [staging04.cnx.org]: FAILED! => {"changed": true, "cmd": "/var/cnx/venvs/cnx-buildout/bin/python bootstrap.py", "delta": "0:00:00.013276", "end": "2017-10-03 08:35:30.042500", "failed": true, "msg": "non-zero return code", "rc": 1, "start": "2017-10-03 08:35:30.029224", "stderr": "", "stderr_lines": [], "stdout": "This account is currently not available.", "stdout_lines": ["This account is currently not available."]}
fatal: [staging05.cnx.org]: FAILED! => {"changed": true, "cmd": "/var/cnx/venvs/cnx-buildout/bin/python bootstrap.py", "delta": "0:00:00.007503", "end": "2017-10-03 08:35:30.049117", "failed": true, "msg": "non-zero return code", "rc": 1, "start": "2017-10-03 08:35:30.041614", "stderr": "", "stderr_lines": [], "stdout": "This account is currently not available.", "stdout_lines": ["This account is currently not available."]}
fatal: [staging06.cnx.org]: FAILED! => {"changed": true, "cmd": "/var/cnx/venvs/cnx-buildout/bin/python bootstrap.py", "delta": "0:00:00.020954", "end": "2017-10-03 08:35:30.074102", "failed": true, "msg": "non-zero return code", "rc": 1, "start": "2017-10-03 08:35:30.053148", "stderr": "", "stderr_lines": [], "stdout": "This account is currently not available.", "stdout_lines": ["This account is currently not available."]}
```
Also see ansible/ansible#26741
Change zope_common run bootstrap task to include `executable` in the
shell command with `www-data` as the user.
Ansible v2.4.0 uses the `become_user` default shell or `$SHELL`
environment variable which is a problem if the `become_user` has
`/usr/sbin/nologin` or `/bin/false` as their default shell. (The
default shell can be found in `/etc/passwd`)
The error when running the main playbook:
```
TASK [zope_common : run bootstrap]
*******************************************************************************************************************************************
fatal: [staging04.cnx.org]: FAILED! => {"changed": true, "cmd": "/var/cnx/venvs/cnx-buildout/bin/python bootstrap.py", "delta": "0:00:00.013276", "end": "2017-10-03 08:35:30.042500", "failed": true, "msg": "non-zero return code", "rc": 1, "start": "2017-10-03 08:35:30.029224", "stderr": "", "stderr_lines": [], "stdout": "This account is currently not available.", "stdout_lines": ["This account is currently not available."]}
fatal: [staging05.cnx.org]: FAILED! => {"changed": true, "cmd": "/var/cnx/venvs/cnx-buildout/bin/python bootstrap.py", "delta": "0:00:00.007503", "end": "2017-10-03 08:35:30.049117", "failed": true, "msg": "non-zero return code", "rc": 1, "start": "2017-10-03 08:35:30.041614", "stderr": "", "stderr_lines": [], "stdout": "This account is currently not available.", "stdout_lines": ["This account is currently not available."]}
fatal: [staging06.cnx.org]: FAILED! => {"changed": true, "cmd": "/var/cnx/venvs/cnx-buildout/bin/python bootstrap.py", "delta": "0:00:00.020954", "end": "2017-10-03 08:35:30.074102", "failed": true, "msg": "non-zero return code", "rc": 1, "start": "2017-10-03 08:35:30.053148", "stderr": "", "stderr_lines": [], "stdout": "This account is currently not available.", "stdout_lines": ["This account is currently not available."]}
```
Also see ansible/ansible#26741
Change zope_common run bootstrap task to include `executable` in the
shell command with `www-data` as the user.
|
Thank you @jrandall this is exactly the piece of documentation that I overlooked. I was focusing too much on the |
…n 2.4.0 Needs executable on users with /sbin/nologin or /sbin/false because it uses $SHELL: ansible/ansible#26741 (comment)
…n 2.4.0 Needs executable on users with /sbin/nologin or /sbin/false because it uses $SHELL: ansible/ansible#26741 (comment)
Ansible 2.4 changed the behaviour of the 'shell' and 'command' modules when used with the 'become' execution method. Now, the modules use the default shell of the account being switched into, instead of the remote user shell. Because the 'list' account (created at Debian installation) uses the '/usr/sbin/nologin' command as the default shell, the tasks that operate under that account need to have an alternative shell specified explicitly. More details: ansible/ansible#26741
|
me helped => sudo pip unistall ansible== 2.4.0 => sudo pip install ansible==2.4.4 |
ISSUE TYPE
COMPONENT NAME
shell
ANSIBLE VERSION
CONFIGURATION
Default
OS / ENVIRONMENT
Host: Ubuntu 16.04
SUMMARY
When using the
shellmodule withbecome_userconfigured to a user whose default shell is/usr/sbin/nologin, the task fails with the message"This account is currently not available.". Settingbecome_flags: '-s /bin/bash'doesn't help either.STEPS TO REPRODUCE
EXPECTED RESULTS
The play succeed on the current 2.3 release:
ACTUAL RESULTS
Extra verbosity
Extra verbosity with
become_flags: '-s /bin/bash'User configuration on the remote machine:
Extra verbosity when the play suceed using ansible 2.3.1.0:
The text was updated successfully, but these errors were encountered: