ansible普通用户执行root权限进行操作

应用中，安全加固后的主机是不允许直接以root用户登陆的，而很多命令又需要root用户来执行。
公司里是通过jumpserver，通过一个普通用户先登陆,再su切到root执行。而且每台主机的普通用户和root用户的密码又不同。
下面使用ansible命令通过普通用户登录执行root权限操作，无需交互输入密码，直接执行后输出结果。

[root@11111111 ~]# ansible -h
# 可以找到相关的命令
Privilege Escalation Options:
  control how and which user you become as on target hosts

  --become-method BECOME_METHOD
                        privilege escalation method to use (default=sudo), use
                        `ansible-doc -t become -l` to list valid choices.
  --become-user BECOME_USER
                        run operations as this user (default=root)
  -K, --ask-become-pass
                        ask for privilege escalation password
  -b, --become          run operations with become (does not imply password
                        prompting)

[root@111111111111111 ~]# vim /etc/ansible/hosts
[backend]
192.168.1.3 ansible_ssh_user=zhangsan ansible_ssh_pass=123456 
192.168.1.4 ansible_ssh_user=zhangsan ansible_ssh_pass=123456

[root@111111111111111 ~] ansible backend -m shell -a "whoami" -b --become-method su --become-user root --ask-become-pass -K
#whoami  获取当前用户
BECOME password:
192.168.1.3 | CHANGED | rc=0 >>
root
192.168.1.4 | CHANGED | rc=0 >>
root 

输入服务器root密码,即可登陆
也可以将root密码写入hosts文件,省略
–ask-become-pass -K

[root@111111111111111 ~] vim /etc/ansible/hosts

[backend]
192.168.1.3 ansible_ssh_user=zhangsan ansible_ssh_pass=123456 ansible_become_pass=12345678
192.168.1.4 ansible_ssh_user=zhangsan ansible_ssh_pass=123456 ansible_become_pass=12345678
#服务器IP地址 ansible_ssh_user=登录此台服务器的普通账户 ansible_ssh_pass=普通用户密码 ansible_become_pass=root用户密码

[root@111111111111111 ~] ansible backend -m shell -a "whoami" -b --become-method su --become-user root
#whoami  获取当前用户
192.168.1.3 | CHANGED | rc=0 >>
root
192.168.1.4 | CHANGED | rc=0 >>
root

获取当前用户是root用户