From 15e7fac723861f2a27ad11e5e31aa1f1214ec06f Mon Sep 17 00:00:00 2001 From: Ant Somers Date: Sat, 11 Jul 2026 18:32:11 +0300 Subject: [PATCH] docs(ansible): document Ubuntu sudo-rs become workaround MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ubuntu 25.10+/26.04 ship sudo-rs as the default sudo, which doesn't honor the custom -p become prompt Ansible waits on — so --ask-become-pass hangs with "Timeout waiting for privilege escalation prompt". Add a per-host, commented `ansible_become_exe: /usr/bin/sudo.ws` opt-in (routes become through classic sudo) plus explanatory notes in the inventory template and README. Kept opt-in and commented so the Ubuntu-26-only path never breaks Debian bookworm / Ubuntu noble hosts. Co-Authored-By: Claude Opus 4.8 (1M context) --- ansible/README.md | 6 ++++++ ansible/inventory/hosts.yml.example | 13 +++++++++++++ 2 files changed, 19 insertions(+) diff --git a/ansible/README.md b/ansible/README.md index 98f1f15..8c58f74 100644 --- a/ansible/README.md +++ b/ansible/README.md @@ -39,6 +39,12 @@ baseline host hardening — DevSec os/ssh, nftables default-deny inbound, - Control machine: **Ansible ≥ 2.15**, `ansible-lint`, `yamllint` (and Docker + `molecule` + `molecule-plugins[docker]` for the anvil molecule scenario). - Target: **Debian (bookworm)** host(s) reachable over SSH with a sudo-capable user. + - **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`, + which doesn't honor the custom `-p` become prompt Ansible relies on — so + `--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On + an affected host uncomment `ansible_become_exe: /usr/bin/sudo.ws` for that host in + `hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through + classic sudo. ## Setup diff --git a/ansible/inventory/hosts.yml.example b/ansible/inventory/hosts.yml.example index 5ef5724..a28f2a2 100644 --- a/ansible/inventory/hosts.yml.example +++ b/ansible/inventory/hosts.yml.example @@ -6,6 +6,17 @@ # First run: connect as a user that can sudo (often root) to bootstrap the box. # After the baseline role creates {{ ssh_admin_user }} and ssh_hardening disables # root login, switch ansible_user to that admin account. +# +# Ubuntu sudo-rs workaround: 25.10 (Questing) and 26.04 ship sudo-rs as the default +# /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and +# waits for it before sending the become password; sudo-rs does not honor that custom +# `-p`, so `--ask-become-pass` / -K hangs with "Timeout waiting for privilege +# escalation prompt". Classic sudo is still installed at /usr/bin/sudo.ws and honors +# the -p prompt Ansible expects — point become at it with the per-host +# `ansible_become_exe` line below. Password sudo is preserved (no NOPASSWD, no host +# change). Only uncomment on an affected host: `sudo --version` reports "sudo-rs" +# and/or /usr/bin/sudo.ws exists. Leave it commented on Debian bookworm / Ubuntu +# noble — that path does not exist there. # PRIMARY: public deCDN node(s) — provisioned by playbooks/site.yml. # Per-node config (contract addresses, region, version, …) goes in the committed @@ -16,6 +27,7 @@ decdn_nodes: decdn-node-1: ansible_host: REPLACE_WITH_NODE_VPS_IP_OR_DNS ansible_user: root + # ansible_become_exe: /usr/bin/sudo.ws # Ubuntu sudo-rs workaround — see note above # INTERNAL: our anvil devnet — provisioned by playbooks/anvil.yml. Keep on a # separate host from the public node(s). @@ -24,3 +36,4 @@ anvil_devnet: anvil-vps: ansible_host: REPLACE_WITH_INTERNAL_VPS_IP_OR_DNS ansible_user: root + # ansible_become_exe: /usr/bin/sudo.ws # Ubuntu sudo-rs workaround — see note above