ansible sudo: sorry, you must have a tty to run sudo

Question

I need to run playbooks on Vagrant boxes and on aws when I setup environment with cloud formation.

In Vagrant file I use ansible-local and everything works fine

name: Setup Unified Catalog Webserver  
    hosts: 127.0.0.1  
    connection: local  
  become: yes  
  become_user: root
  roles: generic

However when I create instance in AWS the ansible playbook fails with error:
sudo: sorry, you must have a tty to run sudo
This happen because it is run as root and it doesnt have tty. But I dont know how to fix it without making change in /etc/sudoers to allow !requiretty

Is there any flags I can setup in ansible.cfg or in my Cloud Formation template?

  "#!/bin/bash\n", "\n", "   
 echo 'Installing Git'\n","  
  yum --nogpgcheck -y install git ansible htop nano wget\n",
 "wget https://s3.eu-central-1.amazonaws.com/XXX -O /root/.ssh/id_rsa\n", 
"chmod 600 /root/.ssh/id_rsa\n", 
"ssh-keyscan 172.31.7.235 >> /root/.ssh/known_hosts\n",
 "git clone git@172.31.7.235:something/repo.git /root/repo\n", 
"ansible-playbook /root/env/ansible/test.yml\n

Why does it need to be ran as root? – ydaetskcoR Feb 24 '16 at 13:24 — ydaetskcoR, Feb 24 '16 at 13:24

score 8 · Answer 1 · edited Jul 04 '17 at 06:59

8

I was able to fix this by setting the transport = paramiko configuration in ansible.cfg.

edited Jul 04 '17 at 06:59

g00glen00b

41,995
13
95
133

answered Jul 04 '17 at 06:53

user8252064

81
1
1

1

Great solution. This worked for me too and is much less intrusive than the accepted answer. – Jontia May 18 '18 at 08:45

score 3 · Accepted Answer · answered Feb 25 '16 at 12:41

I have found the following solutions for myself:
1. Change requiretty in /etc/sudoers with sed run playbooks and change it back.

 "#!/bin/bash\n", "\n", "  
 echo 'Installing Git'\n"," 
 yum --nogpgcheck -y install git ansible htop nano wget\n",  
 "wget https://s3.eu-central-1.amazonaws.com/xx/ansible -O /root/.ssh/id_rsa\n",  
 "chmod 600 /root/.ssh/id_rsa\n",   
  "ssh-keyscan 172.31.9.231 >> /root/.ssh/known_hosts\n",   
  "git clone git@172.31.5.254:somerepo/dev.git /root/dev\n",   
  "sed -i 's/Defaults    requiretty/Defaults    !requiretty/g' /etc/sudoers\n", 
  "\n", 
  "ansible-playbook /root/dev/env/ansible/uk.yml\n",   
  "\n",   
  "sed -i 's/Defaults    !requiretty/Defaults    requiretty/g' /etc/sudoers\n"

OR 2. In ansible playbook specify variable:

 - name: Setup 
 hosts: 127.0.0.1
 connection: local
 sudo: {{ require_sudo }}
 roles:
    - generic

Run in AWS Cloud Formation template would be

   "ansible-playbook -e require_sudo=False /root/dev/env/ansible/uk.yml\n"

And for Vagrant in ansible.cfg it can be specified

  require_sudo=True

Also in CF template may identify who is running and the pass variable

ansible-playbook -e$(id -u |egrep '^0$' > /dev/null && require_sudo=False || require_sudo=True; echo "require_sudo=$require_sudo") /apps/ansible/uk.yml

`sudo` is deprecated in ansible, `become` and `become_user` are supported to be used. — sorin, Mar 09 '17 at 15:12

score 1 · Answer 3 · answered Jun 12 '20 at 17:08

If you need to specific connection: paramiko within just one playbook versus a global configuration in ansible.cfg, you can add connection: paramiko following in the playbook, example:

- name: Run checks after deployments
  hosts: all
  # https://github.com/paramiko/paramiko/issues/1369
  connection: paramiko
  gather_facts: True

ansible sudo: sorry, you must have a tty to run sudo

3 Answers3