Most servers will be initially deployed with a direct SSH access for root with a SSH key or only a password so you can configure the server. Because of security issues, I want to configure a new user with sudo privileges and disable the direct access for root.

I want to create an Ansible Playbook which can do this task for me, however I do not know if it is possible to set ansible_user, ansible_become and so on depending on a condition like "Can you ssh as root?". Is it even possible to let Ansible detect this while running the playbook?


Yes, it's possible, but most solutions are going to look pretty complicated at first glance. You might be better off simply defining a "bootstrap" playbook that you only ever execute once. That's what I have to install python and setup initial user.

However, to answer the question directly, here's a solution that should work:

# Experiment to "fix" `ansible_user` depending upon host availability
- hosts: all
  gather_facts: false  # Otherwise initial connection will fail

    - bootstrap_user: root

    - debug:
        msg: |
          ansible_user: {{ ansible_user | d('unset') }};
          remote_user: {{ remote_user | d('unset') }}

    - action: ping
      ignore_unreachable: true  # requires Ansible >= 2.7
      ignore_errors: yes
      register: pingtest

    # Works (mostly) for Ansible >= 2.2.
    # Might think this alone would work, but only if NOT *ALL* hosts failed up to
    # this point, which makes running the playbook on only a single host pointless.
    # Therefore, also set `ignore_unrechable` in `ping` above.
    # - https://github.com/ansible/ansible/issues/26362
    # - https://github.com/ansible/ansible/issues/19673
    # - https://github.com/ansible/ansible/issues/18075
    - meta: clear_host_errors

    - name: set ansible_user if no ping failed
        ansible_user: "{{ bootstrap_user }}"
      when: pingtest.failed | d(pingtest.unreachable) | d(false)

    - debug:
        msg: "ansible_user: {{ ansible_user | d('unset') }}"

    # Connect as ansible_user from here on
    - name: Show remote user
      shell: "echo $USER"
      changed_when: false

In general, the following two refs will help you with understanding variables (and precedence, which is important here) as well as error recovery:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.