Privilege Escalation (erm, how?)

[LostInTheWoods]

Hi,

I connect to a server using a non-root user account and want to escalate the user's privilege when creating directories etc. But at the moment the user's privileges are not escalated and I get "permission denied" errors. Works OK on the CLI with ansible-playbook.

I have tried adding sudo credentials in the inventory and I have "become" in my playbooks, but no escalation. Am I doing something wrong, or does Semaphore not support privilege escalation? Should I connect as root?

Any advice would be great.

[LostInTheWoods]

I have just been digging around the Ansible CLI and Semaphore debug and it seems there is no privilege escalation executed by Semaphore. Below are the two rows that correspond to the become: yes row in the playbook:

Ansible CLI: (escalation)
'/bin/sh -c '"'"'sudo -H -S -p "[sudo via ansible, key=kfkxkbtnoawiqxfplijhxptdcmqdtnsp] password:" -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-kfkxkbtnoawiqxfplijhxptdcmqdtnsp ; /usr/bin/python3 /home/ansible/.ansible/tmp/ansible-tmp-1636972791.2193456-485450-113909729880111/AnsiballZ_setup.py'"'"'"'"'"'"'"'"' && sleep 0'"'"'' Escalation succeeded

Semaphore: (no escalation)
'/bin/sh -c '"'"'/usr/bin/python3 /home/ansible/.ansible/tmp/ansible-tmp-1636970675.1062553-484855-35233260983330/AnsiballZ_setup.py && sleep 0'"'"''

Is this a bug?

[fiftin]

Did you try Sudo Credentials option of Inventory?

[LostInTheWoods]

Yes I did. I am trying to connect with the "User credential" which is a SSH key (type=ssh) in the key store and escalate privileges with a login password (type=login_password) as the sudo credential. Both use the same user ("ansible"). I imagine that the existence of a sudo credential should trigger the escalation, but that is not what I am seeing.

[LostInTheWoods]

It has been a while since I posted last, is this a bug or am I doing something wrong? Is it more normal to log onto nodes using the root account so privilege escalation is not required?

I need to deliver an interface to Ansible soon, I would like it to be Semaphore, but this is a potential deal breaker.

Cheers,
Stephen

[LeonardoSalvucci]

@LostInTheWoods I can figure out how to do it. My problem was Credential Keys has both user and pass and using it as sudo for inventory, semaphore use that user to become_user so never goes to root.
Make another Credential Key only with password (not user) and use that key to sudo option in inventory.

[eisemakr]

Thanks that really helped me :)

[LostInTheWoods]

@LeonardoSalvucci Sorry I was not able to respond earlier, caught Covid-19 which kept me away for a week or so. Well done for figuring this out, I did as you said and it works perfectly. The interface should give a little more guidance I think, but once you know how it works, it works well.

Thanks for your help, much appreciated.

Stephen

[LeonardoSalvucci]

Hi stephen @LostInTheWoods
Glad to hear you got over covid!💪 and good to know that this was a solution!
Happy admins!!!

Leonardo

[ACNKTN-SIG]

@LeonardoSalvucci Thank you very much, after more then 2 years your post is still helping people 💪