Ansible 'This command has to be run under the root user' Error: Fix with become

By Luca Berton · Published 2024-01-01 · Category: installation

Fix the Ansible error 'This command has to be run under the root user'. Enable privilege escalation with become, become_method, and sudoers configuration.

Ansible 'This command has to be run under the root user' Error: Fix with become

Introduction

Today we're going to talk about Ansible troubleshooting, specifically about the "This command has to be run under the root user" message. This fatal error message happens when we are trying to execute a module that requires more privilege during module execution. These circumstances are usually related to Ansible Playbook or Ansible configuration.

Playbook

The best way of talking about Ansible troubleshooting is to jump in a live Playbook to show you practically the "This command has to be run under the root user" and how to solve it! This Playbook is going to try to install the "rsync" package on our target system.

error code

---
- name: Troubleshooting under the root user
  hosts: all
  become: false
  tasks:
    - name: rsync installed
      ansible.builtin.package:
        name: rsync
        state: present

error execution

ansible-pilot $ ansible-playbook -i virtualmachines/demo/inventory troubleshooting/under_root_user_error.yml
PLAY [Troubleshooting under the root user] ********************************************************
TASK [Gathering Facts] ****************************************************************************
ok: [demo.example.com]
TASK [rsync installed] ****************************************************************************
fatal: [demo.example.com]: FAILED! => {"changed": false, "msg": "This command has to be run under the root user.", "results": []}
PLAY RECAP ****************************************************************************************
demo.example.com           : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0
ansible-pilot $

fix code

---
- name: Troubleshooting under the root user
  hosts: all
  become: true
  tasks:
    - name: rsync installed
      ansible.builtin.package:
        name: rsync
        state: present

fix execution

ansible-pilot $ ansible-playbook -i virtualmachines/demo/inventory troubleshooting/under_root_user_fix.yml
PLAY [Troubleshooting under the root user] ********************************************************
TASK [Gathering Facts] ****************************************************************************
ok: [demo.example.com]
TASK [rsync installed] ****************************************************************************
ok: [demo.example.com]
PLAY RECAP ****************************************************************************************
demo.example.com           : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
ansible-pilot $

code with ❤️ in GitHub

Conclusion

Now you know better how to troubleshoot the Ansible "This command has to be run under the root user." message.

Fix: Enable become

Task level

- name: Install package
  ansible.builtin.apt:
    name: nginx
    state: present
  become: true

Play level

- hosts: all
  become: true
  tasks:
    - ansible.builtin.apt:
        name: nginx
        state: present

Command line

ansible-playbook site.yml --become --ask-become-pass

Become Methods

Method	Platform	Example
`sudo`	Linux (default)	`become_method: sudo`
`su`	Linux	`become_method: su`
`runas`	Windows	`become_method: runas`
`doas`	OpenBSD	`become_method: doas`

Become a specific user

- name: Run as postgres
  ansible.builtin.command: pg_dump mydb
  become: true
  become_user: postgres

Sudoers Configuration

Passwordless sudo for Ansible

- name: Configure passwordless sudo
  ansible.builtin.copy:
    content: "{{ ansible_user }} ALL=(ALL) NOPASSWD: ALL"
    dest: /etc/sudoers.d/ansible
    mode: '0440'
    validate: visudo -cf %s
  become: true

Mixed Privilege Tasks

- name: Read file (no root needed)
  ansible.builtin.command: cat /etc/hostname
  changed_when: false

- name: Install package (root required)
  ansible.builtin.apt:
    name: nginx
    state: present
  become: true

- name: Run as postgres
  ansible.builtin.command: psql -c "SELECT 1;"
  become: true
  become_user: postgres

Provide Become Password

# Interactive
ansible-playbook site.yml --ask-become-pass

# In inventory
ansible_become_password: "{{ vault_sudo_password }}"

FAQ

become vs become_user?

become: true - escalate privileges (default: to root)
become_user: postgres - escalate to specific user

Does become work on Windows?

Yes, use become_method: runas:

become: true
become_method: runas
become_user: Administrator

Category: installation

Watch the video: Ansible 'This command has to be run under the root user' Error: Fix with become — Video Tutorial

Browse all Ansible tutorials · AnsiblePilot Home

AnsiblePilot — Master Ansible Automation

Popular Topics

About Luca Berton