How to Use the -b Flag in Ansible for Privilege Escalation

How to Use the -b Flag in Ansible for Privilege Escalation

Ansible is a powerful automation tool for managing and provisioning servers. Often, you’ll need to run commands or tasks with elevated privileges, like root or other superusers. By default, Ansible runs tasks as the user invoking the playbook, which may not always have the required permissions to complete certain operations. This is where the -b flag (short for "become") comes into play.

In this article, we will explore the use of the -b flag in Ansible, why it’s essential for privilege escalation, and how to use it effectively in various situations.

What is the -b Flag in Ansible?

The -b flag is used in Ansible to tell the system to run specific tasks or an entire playbook with elevated privileges, typically through the "become" mechanism. This is useful when a task requires administrative privileges but the user running the playbook does not have them by default.

The -b flag is used in conjunction with become in Ansible, which is Ansible's method of privilege escalation. By default, become uses sudo to execute commands as another user, usually the root user.

Syntax for the -b Flag

The basic syntax for using the -b flag when running an Ansible playbook or ad-hoc command is as follows:

Ad-hoc command:

ansible all -m shell -a "whoami" -b

In this example, Ansible runs the command whoami with elevated privileges on all hosts. Without -b, Ansible would execute the command as the regular user. With -b, the command is run as the user specified by the become_user (typically root by default).

Running a playbook:

ansible-playbook playbook.yml -b

Here, the -b flag will escalate privileges for all tasks in the playbook.yml file.

How Privilege Escalation Works in Ansible

Ansible’s become mechanism works similarly to sudo on Linux systems. When you use the -b flag, Ansible attempts to escalate privileges before executing tasks. By default, it uses sudo, but it can also use other methods like su, doas, or pbrun, depending on the environment and configuration.

Privilege escalation in Ansible happens on a per-task basis. This means you can specify which tasks require elevated privileges rather than running the entire playbook with root permissions. This is done by setting the become option for individual tasks or entire plays.

Example 1: Privilege Escalation for an Entire Playbook

To run a playbook with elevated privileges for all tasks, you can either use the -b flag at runtime or set the become: true option in the playbook itself.

Playbook Example:

---
- hosts: webservers
  become: true   # Enable privilege escalation for all tasks
  tasks:
    - name: Install Apache
      apt:
        name: apache2
        state: present

In this example, every task in the play will be executed with elevated privileges because of the become: true directive.

Example 2: Privilege Escalation for a Specific Task

You may not always want every task in your playbook to run with elevated privileges. In this case, you can selectively use privilege escalation for certain tasks.

Playbook Example:

---
- hosts: webservers
  tasks:
    - name: Install Apache
      apt:
        name: apache2
        state: present
      become: true   # Enable privilege escalation only for this task

    - name: Ensure Apache service is running
      service:
        name: apache2
        state: started

In this example, only the Install Apache task will be run with elevated privileges, while the Ensure Apache service is running task will be executed as the default user.

Example 3: Running as a Different User

By default, the -b flag uses sudo to become the root user. However, you can specify a different user to escalate to by using the --become-user option.

Example:

ansible-playbook playbook.yml -b --become-user=deploy

This command runs the playbook with privileges of the deploy user instead of root.

You can also define this in the playbook itself:

---
- hosts: app_servers
  become: true
  become_user: deploy   # Become the deploy user
  tasks:
    - name: Deploy the application
      git:
        repo: https://github.com/example/app.git
        dest: /var/www/app

Example 4: Using -b with Ad-hoc Commands

In addition to running playbooks, the -b flag can be used with ad-hoc Ansible commands to execute one-off tasks with escalated privileges.

Example:

ansible all -m shell -a "apt-get update" -b

This runs the apt-get update command on all hosts in the inventory with root privileges.

Controlling How Ansible Becomes Another User

Ansible supports multiple methods for escalating privileges, not just sudo. You can control which method is used with the become_method option.

Common become_method values include:

• sudo (default)
• su
• pbrun
• doas

You can specify the method like this:

ansible-playbook playbook.yml -b --become-method=su

Or in the playbook:

---
- hosts: all
  become: true
  become_method: su
  tasks:
    - name: Run a task as root
      command: whoami

Example 5: Using the --ask-become-pass Flag

In some cases, the user may need to provide a password for privilege escalation. To prompt the user for a password when running the playbook, use the --ask-become-pass option.

Example:

ansible-playbook playbook.yml -b --ask-become-pass

This will prompt the user to enter the sudo password before running tasks that require elevated privileges.

The -b flag in Ansible is a powerful tool for managing privilege escalation. By allowing tasks or entire playbooks to run with elevated privileges, it ensures that you can execute administrative tasks safely and effectively. Whether you're installing packages, modifying system configurations, or managing files that require root access, the -b flag combined with Ansible’s flexible privilege escalation mechanisms makes it easy to automate such tasks.

By mastering the use of the -b flag, you can better manage your infrastructure while maintaining security and control over which tasks are run with elevated privileges.