[galaxy-dev] Re: Ansible Galaxy using root user for role installation
It is not actually, in my investigation, coming from an Ansible default.
There's code inside the Galaxy role that tries to figure out which user to
use for remote_user (the one used in SSH) and when it is run with `become:
true` ends up incorrectly choosing root. However people more knowledgeable
than me don't have this problem. Perhaps something changed in some version
somewhere?
Peter
On Mon, 15 Feb 2021 at 17:16, Michael Moore
wrote:
> Anything attempting to login remotely as root must be rejected. Peter's
> policy approach is good for that. Most modern linices will not allow a
> remote root login, which is correct. There are SSH ways to accomplish the
> same thing, but depend on trust at both ends. The defaulting by Ansible is
> reprehensible, but usually should be expected to fail.
>
>
> On Mon, Feb 15, 2021 at 5:15 AM Peter van Heusden wrote:
>
>> Hi there
>>
>> I found I had this problem too, when the `become: true` applied to the
>> whole Galaxy play. My current top level playbook (at
>> https://github.com/pvanheus/masters_galaxy_ansible/blob/master/galaxy.yml#L25)
>> now applies `become: true` as it is needed, and does not apply it to the
>> `galaxyproject.galaxy` role. I found that this avoids Ansible trying to log
>> in as the root user.
>>
>> Peter
>>
>> On Mon, 15 Feb 2021 at 07:21, Sandra Maksimovic <
>> sandra.maksimo...@mcri.edu.au> wrote:
>>
>>> Hi there,
>>>
>>>
>>>
>>> Would anyone happen to know why Ansible tries to connect to a remote
>>> host (CentOS 7) using 'root' during Galaxy role installation?
>>>
>>>
>>>
>>> My playbook has been configured to connect to the remote host using a
>>> different user account via SSH, however, the role installation is not
>>> honoring this for some reason and continues to use root. The remote host
>>> has had SSH root login disabled for security reasons and setting various
>>> galaxy user/privsep/become/remote user variables in the group_vars has not
>>> had any effect.
>>>
>>>
>>>
>>> TASK [galaxyproject.galaxy : Create galaxy_root] *
>>>
>>> fatal: [server_name]: UNREACHABLE! => {"changed": false, "msg":
>>> "Invalid/incorrect password: Permission denied, please try
>>> again.\r\nPermission denied, please try again.\r\nroot@server_name:
>>> Permission denied (publickey,password).", "unreachable": true}
>>>
>>>
>>>
>>> Thanks,
>>>
>>> Sandra
>>>
>>>
>>> This e-mail and any attachments to it (the "Communication") are, unless
>>> otherwise stated, confidential, may contain copyright material and is for
>>> the use only of the intended recipient. If you receive the Communication in
>>> error, please notify the sender immediately by return e-mail, delete the
>>> Communication and the return e-mail, and do not read, copy, retransmit or
>>> otherwise deal with it. Any views expressed in the Communication are those
>>> of the individual sender only, unless expressly stated to be those of
>>> Murdoch Children’s Research Institute (MCRI) ABN 21 006 566 972 or any of
>>> its related entities. MCRI does not accept liability in connection with the
>>> integrity of or errors in the Communication, computer virus, data
>>> corruption, interference or delay arising from or in respect of the
>>> Communication.
>>> ___
>>> Please keep all replies on the list by using "reply all"
>>> in your mail client. To manage your subscriptions to this
>>> and other Galaxy lists, please use the interface at:
>>> %(web_page_url)s
>>>
>>> To search Galaxy mailing lists use the unified search at:
>>> http://galaxyproject.org/search/
>>
>> ___
>> Please keep all replies on the list by using "reply all"
>> in your mail client. To manage your subscriptions to this
>> and other Galaxy lists, please use the interface at:
>> %(web_page_url)s
>>
>> To search Galaxy mailing lists use the unified search at:
>> http://galaxyproject.org/search/
>
>
___
Please keep all replies on the list by using "reply all"
in your mail client. To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
%(web_page_url)s
To search Galaxy mailing lists use the unified search at:
http://galaxyproject.org/search/
[galaxy-dev] ***UNCHECKED*** Re: Re: Ansible Galaxy using root user for role installation
Anything attempting to login remotely as root must be rejected. Peter's
policy approach is good for that. Most modern linices will not allow a
remote root login, which is correct. There are SSH ways to accomplish the
same thing, but depend on trust at both ends. The defaulting by Ansible is
reprehensible, but usually should be expected to fail.
On Mon, Feb 15, 2021 at 5:15 AM Peter van Heusden wrote:
> Hi there
>
> I found I had this problem too, when the `become: true` applied to the
> whole Galaxy play. My current top level playbook (at
> https://github.com/pvanheus/masters_galaxy_ansible/blob/master/galaxy.yml#L25)
> now applies `become: true` as it is needed, and does not apply it to the
> `galaxyproject.galaxy` role. I found that this avoids Ansible trying to log
> in as the root user.
>
> Peter
>
> On Mon, 15 Feb 2021 at 07:21, Sandra Maksimovic <
> sandra.maksimo...@mcri.edu.au> wrote:
>
>> Hi there,
>>
>>
>>
>> Would anyone happen to know why Ansible tries to connect to a remote host
>> (CentOS 7) using 'root' during Galaxy role installation?
>>
>>
>>
>> My playbook has been configured to connect to the remote host using a
>> different user account via SSH, however, the role installation is not
>> honoring this for some reason and continues to use root. The remote host
>> has had SSH root login disabled for security reasons and setting various
>> galaxy user/privsep/become/remote user variables in the group_vars has not
>> had any effect.
>>
>>
>>
>> TASK [galaxyproject.galaxy : Create galaxy_root] *
>>
>> fatal: [server_name]: UNREACHABLE! => {"changed": false, "msg":
>> "Invalid/incorrect password: Permission denied, please try
>> again.\r\nPermission denied, please try again.\r\nroot@server_name:
>> Permission denied (publickey,password).", "unreachable": true}
>>
>>
>>
>> Thanks,
>>
>> Sandra
>>
>>
>> This e-mail and any attachments to it (the "Communication") are, unless
>> otherwise stated, confidential, may contain copyright material and is for
>> the use only of the intended recipient. If you receive the Communication in
>> error, please notify the sender immediately by return e-mail, delete the
>> Communication and the return e-mail, and do not read, copy, retransmit or
>> otherwise deal with it. Any views expressed in the Communication are those
>> of the individual sender only, unless expressly stated to be those of
>> Murdoch Children’s Research Institute (MCRI) ABN 21 006 566 972 or any of
>> its related entities. MCRI does not accept liability in connection with the
>> integrity of or errors in the Communication, computer virus, data
>> corruption, interference or delay arising from or in respect of the
>> Communication.
>> ___
>> Please keep all replies on the list by using "reply all"
>> in your mail client. To manage your subscriptions to this
>> and other Galaxy lists, please use the interface at:
>> %(web_page_url)s
>>
>> To search Galaxy mailing lists use the unified search at:
>> http://galaxyproject.org/search/
>
> ___
> Please keep all replies on the list by using "reply all"
> in your mail client. To manage your subscriptions to this
> and other Galaxy lists, please use the interface at:
> %(web_page_url)s
>
> To search Galaxy mailing lists use the unified search at:
> http://galaxyproject.org/search/
___
Please keep all replies on the list by using "reply all"
in your mail client. To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
%(web_page_url)s
To search Galaxy mailing lists use the unified search at:
http://galaxyproject.org/search/
[galaxy-dev] Re: Ansible Galaxy using root user for role installation
Hi there
I found I had this problem too, when the `become: true` applied to the
whole Galaxy play. My current top level playbook (at
https://github.com/pvanheus/masters_galaxy_ansible/blob/master/galaxy.yml#L25)
now applies `become: true` as it is needed, and does not apply it to the
`galaxyproject.galaxy` role. I found that this avoids Ansible trying to log
in as the root user.
Peter
On Mon, 15 Feb 2021 at 07:21, Sandra Maksimovic <
sandra.maksimo...@mcri.edu.au> wrote:
> Hi there,
>
>
>
> Would anyone happen to know why Ansible tries to connect to a remote host
> (CentOS 7) using 'root' during Galaxy role installation?
>
>
>
> My playbook has been configured to connect to the remote host using a
> different user account via SSH, however, the role installation is not
> honoring this for some reason and continues to use root. The remote host
> has had SSH root login disabled for security reasons and setting various
> galaxy user/privsep/become/remote user variables in the group_vars has not
> had any effect.
>
>
>
> TASK [galaxyproject.galaxy : Create galaxy_root] *
>
> fatal: [server_name]: UNREACHABLE! => {"changed": false, "msg":
> "Invalid/incorrect password: Permission denied, please try
> again.\r\nPermission denied, please try again.\r\nroot@server_name:
> Permission denied (publickey,password).", "unreachable": true}
>
>
>
> Thanks,
>
> Sandra
>
>
> This e-mail and any attachments to it (the "Communication") are, unless
> otherwise stated, confidential, may contain copyright material and is for
> the use only of the intended recipient. If you receive the Communication in
> error, please notify the sender immediately by return e-mail, delete the
> Communication and the return e-mail, and do not read, copy, retransmit or
> otherwise deal with it. Any views expressed in the Communication are those
> of the individual sender only, unless expressly stated to be those of
> Murdoch Children’s Research Institute (MCRI) ABN 21 006 566 972 or any of
> its related entities. MCRI does not accept liability in connection with the
> integrity of or errors in the Communication, computer virus, data
> corruption, interference or delay arising from or in respect of the
> Communication.
> ___
> Please keep all replies on the list by using "reply all"
> in your mail client. To manage your subscriptions to this
> and other Galaxy lists, please use the interface at:
> %(web_page_url)s
>
> To search Galaxy mailing lists use the unified search at:
> http://galaxyproject.org/search/
___
Please keep all replies on the list by using "reply all"
in your mail client. To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
%(web_page_url)s
To search Galaxy mailing lists use the unified search at:
http://galaxyproject.org/search/
