Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 21. Managing sudo access using an Ansible playbook

Learn more about managing sudo access of users in RHEL Identity Management using an Ansible playbook. For details about granting sudo access to users in RHEL Identity Management, see Granting sudo access to an IdM user on an IdM client.

21.1. Using an Ansible playbook to ensure sudo access for an IdM user on an IdM client

In RHEL Identity Management (IdM), you can ensure sudo access to a specific command is granted to an IdM user account on a specific IdM host.

Complete this procedure to ensure a sudo rule named idm_user_reboot exists. The rule grants idm_user the permission to run the /usr/sbin/reboot command on the idmclient machine.

Prerequisites

  • You have configured your Ansible control node to meet the following requirements:

    • You are using Ansible version 2.15 or later.
    • You have installed the freeipa.ansible_freeipa collection.
    • The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
    • The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file.
  • The target node, that is the node on which the freeipa.ansible_freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.
  • You have ensured the presence of a user account for idm_user in IdM and unlocked the account by creating a password for the user. For details on adding a new IdM user using the command line, see Adding users using the command line.
  • No local idm_user account exists on idmclient. The idm_user user is not listed in the /etc/passwd file on idmclient.

Procedure

  1. Add one or more sudo commands:

    1. Create an ensure-reboot-sudocmd-is-present.yml Ansible playbook that ensures the presence of the /usr/sbin/reboot command in the IdM database of sudo commands. To simplify this step, you can copy and modify the example in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/sudocmd/ensure-sudocmd-is-present.yml file: 

      ---
- name: Playbook to manage sudo command
  hosts: ipaserver

  vars_files:
  - /home/user_name/MyPlaybooks/secret.yml
  tasks:
  # Ensure sudo command is present
  - freeipa.ansible_freeipa.ipasudocmd:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: /usr/sbin/reboot
      state: present
      Copy to Clipboard

    2. Run the playbook: 

      $ ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-reboot-sudocmd-is-present.yml
      Copy to Clipboard

  2. Create a sudo rule that references the commands:

    1. Create an ensure-sudorule-for-idmuser-on-idmclient-is-present.yml Ansible playbook that uses the sudo command entry to ensure the presence of a sudo rule. The sudo rule allows idm_user to reboot the idmclient machine. To simplify this step, you can copy and modify the example in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/sudorule/ensure-sudorule-is-present.yml file: 

      ---
- name: Tests
  hosts: ipaserver

  vars_files:
  - /home/user_name/MyPlaybooks/secret.yml
  tasks:
  # Ensure a sudorule is present granting idm_user the permission to run /usr/sbin/reboot on idmclient
  - freeipa.ansible_freeipa.ipasudorule:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: idm_user_reboot
      description: A test sudo rule.
      allow_sudocmd: /usr/sbin/reboot
      host: idmclient.idm.example.com
      user: idm_user
      state: present
      Copy to Clipboard

    2. Run the playbook: 

      $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-sudorule-for-idmuser-on-idmclient-is-present.yml
      Copy to Clipboard

Verification

Test that the sudo rule whose presence you have ensured on the IdM server works on idmclient by verifying that idm_user can reboot idmclient using sudo. Note that it can take a few minutes for the changes made on the server to take effect on the client.

  1. Log in to idmclient as idm_user.

  2. Reboot the machine using sudo. Enter the password for idm_user when prompted: 

    $ sudo /usr/sbin/reboot
[sudo] password for idm_user:
    Copy to Clipboard

If sudo is configured correctly, the machine reboots.

21.2. Managing multiple IdM sudo rules in a single Ansible task

Using the sudorules option available in the freeipa.ansible_freeipa.ipasudorule collection module, you can ensure the presence or absence of multiple Identity Management (IdM) sudo rules in a single Ansible task. Using the option, you can thus define your sudo rules more easily, and execute them more efficiently.

Prerequisites

  • On the control node:

    • You are using Ansible version 2.15 or later.
    • You have installed the ansible-freeipa package.
    • The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
    • The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file.
  • The target node, that is the node on which the freeipa.ansible_freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.

The example further assumes the following:

  • The user01 and user02 users exist in IdM.
  • The usergroup01 user group exists in IdM.
  • The hostgroup01 and hostgroup02 host groups exist in IdM.

Procedure

  1. Navigate to the ~/MyPlaybooks/ directory: 

    $ cd ~/MyPlaybooks/
    Copy to Clipboard

  2. Create an ensure-presence-of-multiple-sudorules-in-a-task.yml file with the following content: 

    ---
- name: Playbook to handle sudorules
  hosts: ipaserver
  become: true

  tasks:
  # Ensure sudo command name: /usr/sbin/dmidecode is present
  - freeipa.ansible_freeipa.ipasudocmd:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: /usr/sbin/dmidecode

  # Ensure sudo command /usr/sbin/reboot is present
  - freeipa.ansible_freeipa.ipasudocmd:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: /usr/sbin/reboot

  # Ensure sudo command /usr/bin/yum is present
  - freeipa.ansible_freeipa.ipasudocmd:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: /usr/bin/yum

  # Ensure a sudo command group is present
  - freeipa.ansible_freeipa.ipasudocmdgroup:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: sudogroup01
      sudocmd:
      - /usr/sbin/dmidecode
      - /usr/sbin/reboot

  - name: Ensure multiple sudo rules are present using batch mode
    freeipa.ansible_freeipa.ipasudorule:
      ipaadmin_password: "{{ ipaadmin_password }}"
      sudorules:
        - name: testrule01
          user:
            - user01
            - user02
          group:
            - usergroup01
          allow_sudocmd:
            - /usr/bin/yum
          allow_sudocmdgroup:
            - sudogroup01
        - name: testrule02
          hostgroup:
            - hostgroup01
            - hostgroup02
    Copy to Clipboard
    NOTE
    Using the sudorules option, you can specify multiple sudo rule variables that only apply to a particular sudo rule. This sudo rule is defined by the name variable, which is the only mandatory variable for the sudorules option. In the example, the user, group, allow_sudocmd, and allow_sudocmdgroup variables are applied to the testrule01 sudo rule.
  3. Save the file.

  4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 

    $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-presence-of-multiple-sudorules-in-a-task.yml
    Copy to Clipboard
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat