Ansible and ForwardAgent for sudo_user

Question

Could someone say me, what am I doing wrong? I'm working with Amazon EC2 instance and want to have agent forwarded to user rails, but when I run next task:

- acl: name={{ item }} etype=user entity=rails permissions=rwx state=present
  with_items:
    - "{{ ansible_env.SSH_AUTH_SOCK|dirname }}"
    - "{{ ansible_env.SSH_AUTH_SOCK }}"
  sudo: true

I see failed result:

(item=/tmp/ssh-ULvzaZpq2U) => {"failed": true, "item": "/tmp/ssh-ULvzaZpq2U"}
msg: path not found or not accessible!

When I try to it manually, without ansible, it looks good:

setfacl -m rails:rwx "$SSH_AUTH_SOCK"
setfacl -m rails:x $(dirname "$SSH_AUTH_SOCK")
sudo -u rails ssh -T [email protected] //Hi KELiON! You've successfully authenticated, but GitHub does not provide shell access.

I even tried to run new instance and run test ansible playbook:

#!/usr/bin/env ansible-playbook
---
- hosts: all
  remote_user: ubuntu
  tasks:
    - user: name=rails
      sudo: true
    - name: Add ssh agent line to sudoers
      lineinfile:
        dest: /etc/sudoers
        state: present
        regexp: SSH_AUTH_SOCK
        line: Defaults env_keep += "SSH_AUTH_SOCK"
      sudo: true
    - acl: name={{ item }} etype=user entity=rails permissions=rwx state=present
      with_items:
        - "{{ ansible_env.SSH_AUTH_SOCK|dirname }}"
        - "{{ ansible_env.SSH_AUTH_SOCK }}"
      sudo: true
    - name: Test that git ssh connection is working.
      command: ssh -T [email protected]
      sudo: true
      sudo_user: rails

ansible.cfg is:

[ssh_connection]
pipelining=True
ssh_args=-o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s

[defaults]
sudo_flags=-HE
hostfile=staging

But the same result. Any ideas?

Answer 1

I had the same issue and found the answer at https://github.com/ansible/ansible/issues/7235#issuecomment-45842303

My solution varied a bit from his, because acl didn’t work for me, so I:

1. Changed ansible.cfg:

    [defaults]
    sudo_flags=-HE
    [ssh_connection]
    # COMMENTED OUT: ssh_args = -o ForwardAgent=yes

2. Added tasks/ssh_agent_hack.yml containing:

    - name: "(ssh-agent hack: grant access to {{ deploy_user }})"
      # SSH-agent socket is forwarded for the current user only (0700 file). Let's change it
      # See: https://github.com/ansible/ansible/issues/7235#issuecomment-45842303
      # See: http://serverfault.com/questions/107187/ssh-agent-forwarding-and-sudo-to-another-user
      become: false
      file: group={{deploy_user}} mode=g+rwx path={{item}}
      with_items:
      - "{{ ansible_env.SSH_AUTH_SOCK|dirname }}"
      - "{{ ansible_env.SSH_AUTH_SOCK }}"

NOTE - the become: false setting is because I ssh in as root - If you ssh in as something else, then you will need to become root to do the fix, and then below become your deploy_user (if it isnt the user you are ssh'ing in as).

3. And then called it from my deploy.yml playbook:

    - hosts: apps
      gather_facts: True
      become: True
      become_user: "{{deploy_user}}"
      pre_tasks:
      - include: tasks/ssh_agent_hack.yml
        tags: [ 'deploy' ]
      roles:
      - { role: carlosbuenosvinos.ansistrano-deploy, tags: [ 'deploy' ] }

Side note - Adding ForwardAgent yes to the host entry in ~/.ssh/config didn't affect what worked (I tried all 8 combinations :- only setting sudo_flags but not ssh_args works but it doesn't matter if you set forwarding on or off in ~/.ssh/config for opensssh - tested under ubuntu trusty)

Also note: I have pipelining=True in ansible.cfg

Answer 2

This worked for me in ansible v2.3.0.0:

$ vi ansible.cfg

[defaults]
roles_path = ./roles
retry_files_enabled = False
[ssh_connection]
ssh_args=-o ControlMaster=auto -o ControlPersist=60s -o ControlPath=/tmp/ansible-ssh-%h-%p-%r -o ForwardAgent=yes

$ vi roles/pull-code/tasks/main.yml

- name: '(Hack: keep SSH forwarding socket)'
  lineinfile:
      dest: /etc/sudoers
      insertafter: '^#?\s*Defaults\s+env_keep\b'
      line: 'Defaults    env_keep += "SSH_AUTH_SOCK"'

- name: '(Hack: grant access to the socket to {{app_user}})'
  become: false
  acl: name='{{item}}' etype=user entity='{{app_user}}' permissions="rwx" state=present
  with_items:
      - "{{ ansible_env.SSH_AUTH_SOCK|dirname }}"
      - "{{ ansible_env.SSH_AUTH_SOCK }}"

- name: Pull the code
  become: true
  become_user: '{{app_user}}'
  git:
      repo: '{{repository}}'
      dest: '{{code_dest}}'
      accept_hostkey: yes