Sudo in Fabric2

Question

I would like to reproduce the behavior of my old Fabric1 script running

sudo('useradd -m -u --groups mygroup myuser')

In that case the remote machine (an Ubuntu AWS instance) would prompt me for my sudo password and I was able to type it in. Even the repeated prompt after a wrong input would work. After that Fabric1 would hold on to that password by keeping the connection open.

In my new Fabric 2.x script I am using within a @task

c.sudo('useradd -m -u --groups mygroup myuser')

I am still getting a user prompt but it does not wait for my response, I am not able to type the password, and it fails as expected with

invoke.exceptions.AuthFailure: The password submitted to prompt '[sudo] password: ' was rejected

Using the --prompt-for-sudo-password argument has the same (or no effect).

I also tried

run('sudo useradd -m -u --groups mygroup myuser')

and received

sudo: no tty present and no askpass program specified

I would preferable not set the askpass program on a machine that worked perfectly without on Fabric 1.x (unless I could do that from my script which would require sudo, I guess).

I have been banging my head against the wall trying to use the complicated and not well documented configuration system but with no success.

What am I missing? If there is extra configuration required, I would like to know the syntax of the config file as well as where to place that file so that it get picked up by the fab CLI command.

Answer 1

It seems to matter that the arguments are passed in before the tasks, so make sure you're not just tacking args on the end of the command. For instance, this fails (doesn't prompt for password, then fails sudo authentication):

$ fab -H myhost mysudotask --prompt-for-sudo-password
[sudo] password: Sorry, try again.
[sudo] password: Traceback (most recent call last):
... <snip> ...
  File "<string>", line 2, in raise_from
invoke.exceptions.AuthFailure: The password submitted to prompt '[sudo] password: ' was rejected.

While the following works as expected (prompting for password, then executing the sudo task):

$ fab -H myhost --prompt-for-sudo-password mysudotask 
Desired 'sudo.password' config value: 
[sudo] password: hi 1