After updating ansible-core, the dzdo directive doesn't work

[super-ben]

Summary

We now use ansible-core-2.16.3-2.el8.x86_64 and realized that our newly faced errors are most probably tied to the community.general.dzdo module (starting with that we have to use this one instead of the old one, dzdo, which worked up until recently).

Now the error I receive whenever I run a playbook is this:

fatal: [hostname]: FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3"}, "changed": false, "module_stderr": "Shared connection to hostname closed.\r\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

The login occurs, but instantly logs out, as well. I read that this issue happens when Ansible can't successfully become another user.

I have the necessary module installed:

ansible-galaxy collection list

# /home/username/.ansible/collections/ansible_collections
Collection        Version
----------------- -------
ansible.posix     2.0.0
community.general 10.4.0

I don't have anything else set up in the ansible.cfg file, the only change I made is that now I use "community.general.dzdo" instead of just "dzdo". As of this moment, I/we can't use Ansible at all, so I would be grateful for some guidance.

Here is the verbose output, as well, if helps:

<hostname> ESTABLISH SSH CONNECTION FOR USER: username
<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' hostname '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo /tmp/.ansible_username/tmp `"&& mkdir "` echo /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029 `" && echo ansible-tmp-1742318995.9893677-3499532-204594822525029="` echo /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029 `" ) && sleep 0'"'"''
<hostname> (0, b'ansible-tmp-1742318995.9893677-3499532-204594822525029=/tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029\n', b"Warning: Permanently added 'hostname,10.244.128.11' (ECDSA) to the list of known hosts.\r\n!!\n!!   WARNING :\n!!\n!!   This is a KBC managed system. You must have prior authorization\n!!   to access this system. All connections are logged and monitored.\n!!   By connecting to this system you fully consent to all monitoring.\n!!   Any unauthorized access or use will be prosecuted to the full\n!!   extent of the law. You have been warned.\n!!\n")
<hostname> Attempting python interpreter discovery
<hostname> ESTABLISH SSH CONNECTION FOR USER: username
<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' hostname '/bin/sh -c '"'"'echo PLATFORM; uname; echo FOUND; command -v '"'"'"'"'"'"'"'"'python3.12'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.11'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.10'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.9'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.8'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.7'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.6'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'/usr/bin/python3'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'/usr/libexec/platform-python'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python2.7'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'/usr/bin/python'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python'"'"'"'"'"'"'"'"'; echo ENDFOUND && sleep 0'"'"''
<hostname> (0, b'PLATFORM\nLinux\nFOUND\n/usr/bin/python3.12\n/usr/bin/python3.9\n/usr/bin/python3\n/usr/libexec/platform-python\n/usr/bin/python\n/usr/bin/python\nENDFOUND\n', b'')
<hostname> ESTABLISH SSH CONNECTION FOR USER: username
<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' hostname '/bin/sh -c '"'"'/usr/bin/python3.12 && sleep 0'"'"''
<hostname> (0, b'{"platform_dist_result": [], "osrelease_content": "NAME=\\"Red Hat Enterprise Linux\\"\\nVERSION=\\"9.5 (Plow)\\"\\nID=\\"rhel\\"\\nID_LIKE=\\"fedora\\"\\nVERSION_ID=\\"9.5\\"\\nPLATFORM_ID=\\"platform:el9\\"\\nPRETTY_NAME=\\"Red Hat Enterprise Linux 9.5 (Plow)\\"\\nANSI_COLOR=\\"0;31\\"\\nLOGO=\\"fedora-logo-icon\\"\\nCPE_NAME=\\"cpe:/o:redhat:enterprise_linux:9::baseos\\"\\nHOME_URL=\\"https://www.redhat.com/\\"\\nDOCUMENTATION_URL=\\"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9\\"\\nBUG_REPORT_URL=\\"https://issues.redhat.com/\\"\\n\\nREDHAT_BUGZILLA_PRODUCT=\\"Red Hat Enterprise Linux 9\\"\\nREDHAT_BUGZILLA_PRODUCT_VERSION=9.5\\nREDHAT_SUPPORT_PRODUCT=\\"Red Hat Enterprise Linux\\"\\nREDHAT_SUPPORT_PRODUCT_VERSION=\\"9.5\\"\\n"}\n', b'')
Using module file /usr/lib/python3.12/site-packages/ansible/modules/file.py
<hostname> PUT /home/username/.ansible/tmp/ansible-local-34995234q55lnvp/tmpmdsdej_x TO /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/AnsiballZ_file.py
<hostname> SSH: EXEC sshpass -d12 sftp -o BatchMode=no -b - -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' '[hostname]'
<hostname> (0, b'sftp> put /home/username/.ansible/tmp/ansible-local-34995234q55lnvp/tmpmdsdej_x /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/AnsiballZ_file.py\n', b'')
<hostname> ESTABLISH SSH CONNECTION FOR USER: username
<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' hostname '/bin/sh -c '"'"'chmod u+x /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/ /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/AnsiballZ_file.py && sleep 0'"'"''
<hostname> (0, b'', b'')
<hostname> ESTABLISH SSH CONNECTION FOR USER: username
<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' -tt hostname '/bin/sh -c '"'"'dzdo -H -S -n  /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-prfrmicpemjnirxbfdtbrzqnbhclkftc ; /usr/bin/python3 /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/AnsiballZ_file.py'"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded
<hostname> (1, b'\r\n', b'Shared connection to hostname closed.\r\n')
<hostname> Failed to connect to the host via ssh: Shared connection to hostname closed.
<hostname> ESTABLISH SSH CONNECTION FOR USER: username
<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' hostname '/bin/sh -c '"'"'rm -f -r /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/ > /dev/null 2>&1 && sleep 0'"'"''
<hostname> (0, b'', b'')
fatal: [hostname]: FAILED! => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": false,
    "module_stderr": "Shared connection to hostname closed.\r\n",
    "module_stdout": "\r\n",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
    "rc": 1
}

Issue Type

Bug Report

Component Name

dzdo

Ansible Version

$ ansible --version
ansible [core 2.16.3]
  config file = /home/username/ansible/ansible.cfg
  configured module search path = ['/home/username/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.12/site-packages/ansible
  ansible collection location = /home/username/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.12.8 (main, Dec  9 2024, 15:25:01) [GCC 8.5.0 20210514 (Red Hat 8.5.0-22)] (/usr/bin/python3.12)
  jinja version = 3.1.2
  libyaml = True

Community.general Version

$ ansible-galaxy collection list community.general
# /home/username/.ansible/collections/ansible_collections
Collection        Version
----------------- -------
community.general 10.4.0

Configuration

$ ansible-config dump --only-changed
CONFIG_FILE() = /home/username/ansible/ansible.cfg
DEFAULT_ASK_PASS(/home/username/ansible/ansible.cfg) = True
DEFAULT_HOST_LIST(/home/username/ansible/ansible.cfg) = ['/home/username/ansible/hosts']
HOST_KEY_CHECKING(/home/username/ansible/ansible.cfg) = False

OS / Environment

RHEL8

Steps to Reproduce

---
- hosts: nfs
  remote_user: username
  become: yes
    #become_method: dzdo
  become_method: community.general.dzdo
  gather_facts: False
  vars:
    mountpoint: /nfs/share
    nfssrc: nfsserver:/shared/share

  tasks:

  - name: Create nfs dirs
    file:
      path: "{{ mountpoint }}"
      state: directory
      mode: '0755'

Expected Results

I expected the "Create nfs dirs" task create the required directories after logging in to the host, after becoming the root user.

Actual Results

fatal: [hostname]: FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3"}, "changed": false, "module_stderr": "Shared connection to hostname closed.\r\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• plugins/become/dzdo.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @None
click here for bot help

[bcoca]

can you check ssh logs on the target? this indicates that dzdo did succeed, but that the connection was closed right after

<hostname> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o 'User="username"' -o ConnectTimeout=10 -o 'ControlPath="/home/username/.ansible/cp/176b7184d7"' -tt hostname '/bin/sh -c '"'"'dzdo -H -S -n  /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-prfrmicpemjnirxbfdtbrzqnbhclkftc ; /usr/bin/python3 /tmp/.ansible_username/tmp/ansible-tmp-1742318995.9893677-3499532-204594822525029/AnsiballZ_file.py'"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded
<hostname> (1, b'\r\n', b'Shared connection to hostname closed.\r\n')

[super-ben]

Sure, thanks a lot! This is when I run the playbook:

2025-03-18 19:25:55 hostname sshd[3755384]: Starting session: command on pts/0 for username from 10.214.143.12 port 33308 id 0
2025-03-18 19:25:55 hostname dzdo[3755568]:   username : command not allowed ; TTY=pts/0 ; PWD=/home/username ; USER=root ; COMMAND=/bin/sh -c echo BECOME-SUCCESS-yuuzxnckgxqbloawrexakykpgeimxqvr ; /usr/bin/python3 /tmp/.ansible_username/tmp/ansible-tmp-1742322354.1379445-3509647-272521178349319/AnsiballZ_file.py
2025-03-18 19:25:55 hostname sshd[3755384]: Close session: user username from 10.214.143.12 port 33308 id 0

Seemingly, it is not allowed to execute the command. But this happens when I log in directly and issue "dzdo su -":

2025-03-18 19:26:08 hostname sshd[3755609]: pam_unix(sshd:session): session opened for user username(uid=521197) by username(uid=0)
2025-03-18 19:26:08 hostname sshd[3755618]: Starting session: shell on pts/0 for username from 10.214.143.12 port 53520 id 0
2025-03-18 19:26:09 hostname dzdo[3755654]:   username : TTY=pts/0 ; PWD=/home/username ; USER=root ; COMMAND=/usr/bin/su -
2025-03-18 19:26:09 hostname su[3755655]: pam_unix(su-l:session): session opened for user root(uid=0) by username(uid=0)

So naturally, my user is allowed to execute this command.

[bcoca]

first, you are using su, not dzdo, while both should do the same thing, it is better to just copy what Ansible is trying to do fo find the issue. In any case 'the command' in question seems to be either /usr/bin/python3 or /bin/sh, or just something in the shell string that dzdo doesn't like (;?).

[super-ben]

I am using dzdo:

username@hostname:~> date; dzdo su -
Tue Mar 18 07:46:41 PM CET 2025
Last login: Tue Mar 18 19:26:09 CET 2025 on pts/0
root@hostname:~> 

Which translates to this:

2025-03-18 19:46:41 hostname dzdo[3758981]:   username : TTY=pts/0 ; PWD=/home/username ; USER=root ; COMMAND=/usr/bin/su -
2025-03-18 19:46:41 hostname su[3758982]: pam_unix(su-l:session): session opened for user root(uid=0) by username(uid=0)

This is how we always used it as we're using Centrify so I don't have any ideas how different it should be, as with the previous module (not the community one) it worked as-is. I faced this issue today when I had to freshly install Ansible to a new host. No change was done to ansible.cfg or any of the playbooks, whatsoever (as I copied everything to the new host). I'm grateful for any ideas.

[felixfontein]

as with the previous module (not the community one) it worked as-is.

Do you mean the become plugin included in Ansible 2.9? So did you upgrade from Ansible 2.9 to ansible-core 2.16 + collections?

In any case, community.general.dzdo's behavior should still be the same as in Ansible 2.9, since no real change was made.

[super-ben]

as with the previous module (not the community one) it worked as-is.

Do you mean the become plugin included in Ansible 2.9?

Yes (you can see how it was invoked earlier, I deliberately left it in the example I've given, commented out). I started using collections by installing the community modules only today.

[felixfontein]

For ansible-base 2.10 and ansible-core 2.11+, dzdo does exactly the same as community.general.dzdo, since there's a redirect (that's still there for ansible-core 2.16 as well). Therefore it's important to know whether the previous version was 2.9 (or before), or 2.10 or later.

[super-ben]

Therefore it's important to know whether the previous version was 2.9 (or before), or 2.10 or later.

I’m sorry but I really can’t tell you and have no means to find out. All I have now (what I do and how) is in this ticket.

[felixfontein]

Regarding dzdo su -: Ansible never ran that, so the change between the older version and 2.16 is that probably the command slightly changed - as @bcoca pointed out in #9899 (comment). The error message in the log explicitly says "command not allowed". I'd probably take a look at the dzdo configuration to see which commands are allowed. Assuming it's not things like ;, my guess is that there's an exception that worked with the older version of Ansible that needs to be updated for 2.16.