Skip to content

docs(ansible): document Ubuntu sudo-rs become workaround #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thiras merged 1 commit into from
Jul 11, 2026
Merged

docs(ansible): document Ubuntu sudo-rs become workaround #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions ansible/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,12 @@ baseline host hardening — DevSec os/ssh, nftables default-deny inbound,
- Control machine: **Ansible ≥ 2.15**, `ansible-lint`, `yamllint` (and Docker + `molecule`
+ `molecule-plugins[docker]` for the anvil molecule scenario).
- Target: **Debian (bookworm)** host(s) reachable over SSH with a sudo-capable user.
- **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`,
which doesn't honor the custom `-p` become prompt Ansible relies on — so
`--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On
an affected host uncomment `ansible_become_exe: /usr/bin/sudo.ws` for that host in
`hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through
classic sudo.
Comment on lines +42 to +47

@gemini-code-assist gemini-code-assist Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Update the reference to classic sudo path to /usr/bin/sudo.classic to match the standard path on Ubuntu/Debian systems.

Suggested change
- **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`,
which doesn't honor the custom `-p` become prompt Ansible relies on — so
`--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On
an affected host uncomment `ansible_become_exe: /usr/bin/sudo.ws` for that host in
`hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through
classic sudo.
- **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`,
which doesn't honor the custom `-p` become prompt Ansible relies on — so
`--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On
an affected host uncomment `ansible_become_exe: /usr/bin/sudo.classic` for that host in
`hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through
classic sudo.


## Setup

Expand Down
13 changes: 13 additions & 0 deletions ansible/inventory/hosts.yml.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,17 @@
# First run: connect as a user that can sudo (often root) to bootstrap the box.
# After the baseline role creates {{ ssh_admin_user }} and ssh_hardening disables
# root login, switch ansible_user to that admin account.
#
# Ubuntu sudo-rs workaround: 25.10 (Questing) and 26.04 ship sudo-rs as the default
# /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and
# waits for it before sending the become password; sudo-rs does not honor that custom
# `-p`, so `--ask-become-pass` / -K hangs with "Timeout waiting for privilege
# escalation prompt". Classic sudo is still installed at /usr/bin/sudo.ws and honors
# the -p prompt Ansible expects — point become at it with the per-host
# `ansible_become_exe` line below. Password sudo is preserved (no NOPASSWD, no host
Comment on lines +10 to +16
# change). Only uncomment on an affected host: `sudo --version` reports "sudo-rs"
# and/or /usr/bin/sudo.ws exists. Leave it commented on Debian bookworm / Ubuntu
# noble — that path does not exist there.
Comment on lines +10 to +19

@gemini-code-assist gemini-code-assist Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The path /usr/bin/sudo.ws does not appear to be a standard path for classic sudo in Ubuntu or Debian. Typically, when sudo-rs is co-installed or default, the classic sudo binary is provided by the sudo-classic package and is located at /usr/bin/sudo.classic. Additionally, the codename for Ubuntu 25.10 has not been officially announced as 'Questing'. It is safer to refer to it simply as '25.10'.

# Ubuntu sudo-rs workaround: 25.10 and 26.04 ship sudo-rs as the default
# /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and
# waits for it before sending the become password; sudo-rs does not honor that custom
# `-p`, so `--ask-become-pass` / -K hangs with "Timeout waiting for privilege
# escalation prompt". Classic sudo is still installed at /usr/bin/sudo.classic and honors
# the -p prompt Ansible expects — point become at it with the per-host
# `ansible_become_exe` line below. Password sudo is preserved (no NOPASSWD, no host
# change). Only uncomment on an affected host: `sudo --version` reports "sudo-rs"
# and/or /usr/bin/sudo.classic exists. Leave it commented on Debian bookworm / Ubuntu
# noble — that path does not exist there.


# PRIMARY: public deCDN node(s) — provisioned by playbooks/site.yml.
# Per-node config (contract addresses, region, version, …) goes in the committed
Expand All @@ -16,6 +27,7 @@ decdn_nodes:
decdn-node-1:
ansible_host: REPLACE_WITH_NODE_VPS_IP_OR_DNS
ansible_user: root
# ansible_become_exe: /usr/bin/sudo.ws # Ubuntu sudo-rs workaround — see note above

@gemini-code-assist gemini-code-assist Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Update the commented workaround path to use /usr/bin/sudo.classic instead of /usr/bin/sudo.ws.

      # ansible_become_exe: /usr/bin/sudo.classic   # Ubuntu sudo-rs workaround — see note above


# INTERNAL: our anvil devnet — provisioned by playbooks/anvil.yml. Keep on a
# separate host from the public node(s).
Expand All @@ -24,3 +36,4 @@ anvil_devnet:
anvil-vps:
ansible_host: REPLACE_WITH_INTERNAL_VPS_IP_OR_DNS
ansible_user: root
# ansible_become_exe: /usr/bin/sudo.ws # Ubuntu sudo-rs workaround — see note above

@gemini-code-assist gemini-code-assist Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Update the commented workaround path to use /usr/bin/sudo.classic instead of /usr/bin/sudo.ws.

      # ansible_become_exe: /usr/bin/sudo.classic   # Ubuntu sudo-rs workaround — see note above

Loading