Fix: Ansible 'Permission denied' with become/sudo

!Symptoms

• Task fails with 'Permission denied' when using become: true
• Error: 'Missing sudo password'
• Tasks work without become but fail privileged operations
• Error: 'user is not in the sudoers file'

?Root Causes

• Remote user not in sudoers or sudo group
• sudo requires a password but ansible_become_password not set
• Sudoers file requires tty but Ansible uses non-interactive SSH
• SELinux or AppArmor blocking privilege escalation
• become_method set incorrectly (e.g., su instead of sudo)

#Diagnosis Steps

1. 1SSH to the host manually and run `sudo -l` to check permissions
2. 2Check if user is in sudo group: `groups <username>`
3. 3Check sudoers: `sudo visudo` or `cat /etc/sudoers.d/<username>`
4. 4Verify become settings: `ansible-config dump | grep BECOME`
5. 5Check SELinux: `sestatus` and `ausearch -m avc -ts recent`

>Fix

1. 1Add user to sudo group: `usermod -aG sudo <username>`
2. 2Set ansible_become_password in vars or use `--ask-become-pass`
3. 3Add NOPASSWD to sudoers: `<username> ALL=(ALL) NOPASSWD:ALL`
4. 4Disable requiretty in sudoers: comment out `Defaults requiretty`
5. 5Set correct become_method in playbook or ansible.cfg

*Prevention

• Provision hosts with proper sudo access as part of bootstrapping
• Use Ansible Vault to store become passwords securely
• Standardize sudo configuration across all managed hosts
• Test privilege escalation as part of inventory validation
• Document which tasks require become and why

Related Error Messages