Ansible 'This command has to be run under the root user' Error: Fix with become

Introduction

Today we're going to talk about Ansible troubleshooting, specifically about the "This command has to be run under the root user" message. This fatal error message happens when we are trying to execute a module that requires more privilege during module execution. These circumstances are usually related to Ansible Playbook or Ansible configuration. I'm Luca Berton and welcome to today's episode of Ansible Pilot.

See also: Ansible PowerShell & sudo Become Error: 'powershell is not compatible' Fix

Playbook

The best way of talking about Ansible troubleshooting is to jump in a live Playbook to show you practically the "This command has to be run under the root user" and how to solve it! This Playbook is going to try to install the "rsync" package on our target system.

error code

---
- name: Troubleshooting under the root user
  hosts: all
  become: false
  tasks:
    - name: rsync installed
      ansible.builtin.package:
        name: rsync
        state: present

See also: Ansible troubleshooting - AWS Failed to import the required Python library (botocore or boto3)

error execution

ansible-pilot $ ansible-playbook -i virtualmachines/demo/inventory troubleshooting/under_root_user_error.yml
PLAY [Troubleshooting under the root user] ********************************************************
TASK [Gathering Facts] ****************************************************************************
ok: [demo.example.com]
TASK [rsync installed] ****************************************************************************
fatal: [demo.example.com]: FAILED! => {"changed": false, "msg": "This command has to be run under the root user.", "results": []}
PLAY RECAP ****************************************************************************************
demo.example.com           : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0
ansible-pilot $

fix code

---
- name: Troubleshooting under the root user
  hosts: all
  become: true
  tasks:
    - name: rsync installed
      ansible.builtin.package:
        name: rsync
        state: present

See also: Ansible troubleshooting - Destination does not exist rc 257

fix execution

ansible-pilot $ ansible-playbook -i virtualmachines/demo/inventory troubleshooting/under_root_user_fix.yml
PLAY [Troubleshooting under the root user] ********************************************************
TASK [Gathering Facts] ****************************************************************************
ok: [demo.example.com]
TASK [rsync installed] ****************************************************************************
ok: [demo.example.com]
PLAY RECAP ****************************************************************************************
demo.example.com           : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
ansible-pilot $

code with ❤️ in GitHub

Conclusion

Now you know better how to troubleshoot the Ansible "This command has to be run under the root user." message.

Fix: Enable become

Task level

- name: Install package
  ansible.builtin.apt:
    name: nginx
    state: present
  become: true

Play level

- hosts: all
  become: true
  tasks:
    - ansible.builtin.apt:
        name: nginx
        state: present

Command line

ansible-playbook site.yml --become --ask-become-pass

Become Methods

| Method | Platform | Example | |--------|----------|---------| | sudo | Linux (default) | become_method: sudo | | su | Linux | become_method: su | | runas | Windows | become_method: runas | | doas | OpenBSD | become_method: doas |

Become a specific user

- name: Run as postgres
  ansible.builtin.command: pg_dump mydb
  become: true
  become_user: postgres

Sudoers Configuration

Passwordless sudo for Ansible

- name: Configure passwordless sudo
  ansible.builtin.copy:
    content: "{{ ansible_user }} ALL=(ALL) NOPASSWD: ALL"
    dest: /etc/sudoers.d/ansible
    mode: '0440'
    validate: visudo -cf %s
  become: true

Mixed Privilege Tasks

- name: Read file (no root needed)
  ansible.builtin.command: cat /etc/hostname
  changed_when: false
- name: Install package (root required)
  ansible.builtin.apt:
    name: nginx
    state: present
  become: true
- name: Run as postgres
  ansible.builtin.command: psql -c "SELECT 1;"
  become: true
  become_user: postgres

Provide Become Password

# Interactive
ansible-playbook site.yml --ask-become-pass
# In inventory
ansible_become_password: "{{ vault_sudo_password }}"

FAQ

become vs become_user?

• become: true - escalate privileges (default: to root) • become_user: postgres - escalate to specific user

Does become work on Windows?

Yes, use become_method: runas:

become: true
become_method: runas
become_user: Administrator

Related Articles

• how Ansible become works under the hood • managing inventory in Ansible