3 ms·
For root rsync in Ansible, have you tried using "become: no" and the synchronize module with "rsync_path: sudo rsync"? IIRC that's worked quite well for me. It
by corney91 6y ago
For root rsync in Ansible, have you tried using "become: no" and the synchronize module with "rsync_path: sudo rsync"? IIRC that's worked quite well for me.
It'd need passwordless sudo so only a minor improvement, but avoiding root login allows you to limit which tasks run as privileged/non-privileged users, tick boxes when it comes to audits, and allows multiple users to run the same playbooks under their own account.
As you've just said, it might not fit everyone's needs, but thought it's worth putting out there for anybody who would prefer not to log in as root.
- klodolph 6y agoIf I wanted to tick boxes when it comes to audits, TBH I would migrate from Ansible to something else where changes get pushed to source control first (before push) and nobody has root access during normal operations. I’m using Ansible specifically because I can push directly from my personal machine. I strongly prefer NOT to have passwordless sudo. Disabling root login and then enabling passwordless sudo seems like a pointless exercise in ticking the boxes—any benefit from disabling root login is undone by enabling passwordless sudo.