Recommended Free Tools
Use Ansible’s become control to run a task or play with another account’s permissions. Set become: true to activate escalation, then use become_user to choose the target identity. The default method is sudo and the default target is root. Keeping escalation at the narrowest practical scope, prompting for passwords correctly, and protecting credentials with Ansible Vault are the foundations of a safe playbook.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Ansible become does
Ansible connects to a managed host as a remote user, transfers a module, and executes that module. Privilege escalation changes the identity under which the module runs. The official Ansible wording is: “Because this feature allows you to ‘become’ another user, different from the user that logged into the machine (remote user), we call it ‘become’.”
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTwo settings are easy to confuse:
become: trueactivates escalation.become_usernames the account whose permissions should execute the task. Setting it alone does not turn escalation on.
If you omit become_method, Ansible normally uses sudo. If you omit become_user, the normal target is root on Unix-like systems. The selected connection plugin and operating system still determine whether a method can work.
Run one privileged task
Task-level escalation is the safest default when only one operation needs extra rights. This example starts a service as root while leaving other tasks at the connection user’s privilege level:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- hosts: web
tasks:
- name: Ensure the web service is running
ansible.builtin.service:
name: httpd
state: started
become: trueTo execute a command as a non-root service account, specify both controls:
- name: Run as apache
ansible.builtin.command: somecommand
become: true
become_user: apacheThe remote connection account still establishes the session. The command runs as apache only after the configured become mechanism authorizes the switch.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallChoose the right escalation scope
Put the setting where the policy actually applies. Broader scope is convenient, but it also increases the number of operations that can run with elevated rights.
| Scope | Typical use | Example setting |
|---|---|---|
| Task | One package, file, service, or command needs elevation | become: true on the task |
| Play | Every task in a play requires the same elevated identity | become: true under the play |
| Inventory | A host or group follows a consistent escalation policy | ansible_become and related connection variables |
| Command line | A one-off run needs an operator-selected policy | ansible-playbook -b |
For play-wide escalation:
- hosts: database
become: true
tasks:
- name: Install database packages
ansible.builtin.package:
name: postgresql
state: present
- name: Start the database service
ansible.builtin.service:
name: postgresql
state: startedAnsible applies normal variable and directive precedence when the same control is supplied in multiple places. Keep the authoritative value in one layer where possible, and verify the effective settings when a command-line option appears to override a playbook value.
Use the command line correctly
The short and long command-line forms are:
-bor--becomeenables escalation.--become-userselects the target account.--become-methodselects the escalation plugin.-Kor--ask-become-passprompts for the escalation password.
For example:
ansible-playbook site.yml --become --become-user root --ask-become-pass-K only asks for a password; it does not activate become. Include -b (or --become) as well. A run that appears frozen after connecting may actually be waiting for a password prompt that is hidden by the terminal, a noninteractive runner, or a logging system.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Configure hosts and groups in inventory
When a host or group has a stable policy, inventory connection variables can define it:
ansible_becomeansible_become_methodansible_become_useransible_become_passwordansible_become_exe
Do not put ansible_become_password in plain-text inventory. Store the value in an Ansible Vault-encrypted variable and load it through the normal variable mechanism. In automated environments, a centralized credential system can supply the secret without exposing it in source control or job output.
A useful separation is to keep identity and method in inventory, while keeping the secret in Vault or a managed automation credential. That makes policy review possible without distributing the password to every person who can read the inventory.
Escalation methods and where they fit
Ansible Core currently lists these become methods: sudo, su, pbrun, pfexec, doas, dzdo, ksu, runas, and machinectl. Become plugins are enabled by default; list the plugins available in your installation with:
ansible-doc -t become -l| Method | Common target or environment | Password and policy considerations |
|---|---|---|
sudo |
Unix-like hosts, usually targeting root | Subject to sudoers rules; may prompt for the invoking user’s password |
su |
Unix-like hosts where a login-style user switch is configured | Uses the target account’s switch policy and password requirements |
doas |
Unix-like systems configured with doas | Authorization comes from doas rules rather than sudoers |
pbrun or dzdo |
Environments using those delegated-privilege tools | Allowed command paths and central policy can restrict execution |
pfexec or ksu |
Platforms configured for those mechanisms | Successful use depends on local profiles and authentication policy |
runas |
Windows managed hosts | The connection account must already be an Administrator; token and service settings matter |
machinectl |
Systems using machinectl-based execution | Requires support from the host and connection configuration |
Only one become method can be enabled for a host at a time, and Ansible cannot chain methods into a sequence such as sudo followed by su. If a policy requires multiple identity transitions, implement that workflow explicitly on the host or through an approved automation design rather than expecting a become chain.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Why a playbook hangs for a sudo password
The prompt was never answered
Run interactively with --ask-become-pass to confirm whether sudo is requesting credentials. In a scheduled job, provide the credential through a protected automation credential or Vault-backed variable instead of relying on an invisible terminal prompt.
Become was not enabled
Check that the play or task contains become: true, or that the command includes -b. Supplying only --become-user changes the requested identity but does not switch users.
The account is not authorized
Test the exact remote account and target identity outside Ansible, then inspect the host’s sudo, su, doas, or equivalent policy. Rules may permit only specific command paths, require a terminal, or deny the requested target user.
The connection is noninteractive
Continuous-integration runners and background jobs cannot answer an interactive prompt. Use a noninteractive credential path supported by your environment, and make sure the job has permission to retrieve it. Avoid printing command output that could reveal secrets.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand the unprivileged-to-unprivileged risk
Ansible transfers a module file to the managed host before executing it. The connection user and become_user are often different unprivileged accounts, such as an operator account switching to a service account. In that case, the target account must be able to read the temporary module.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Ansible may try POSIX access-control lists first, then a configured common group through ansible_common_remote_group. In some configurations it can fall back to a world-readable temporary directory. Module files can contain parameters, including sensitive values, so another local user who can read that directory may obtain information that was intended only for the task.
What world_readable_temp changes
Since Ansible 2.1, the default behavior is to stop with an error when Ansible cannot execute the module securely. Enabling world_readable_temp changes that failure to a warning and permits the task to continue. Treat this as an explicit risk decision for trusted managed nodes, not as a routine workaround. Prefer a shared group or ACL configuration that grants access only to the intended accounts.
Platform-specific behavior
Network automation
For network devices that support a privileged EXEC or enable context, use become: true with become_method: enable and a network_cli or httpapi connection. Device support varies, so confirm that the platform’s connection plugin implements enable mode and that the account is allowed to enter it.
- hosts: switches
connection: ansible.netcommon.network_cli
become: true
become_method: enable
tasks:
- name: Show privileged configuration
ansible.netcommon.cli_command:
command: show running-configWindows hosts
Windows uses the same inventory and command-line naming pattern, with become_method: runas. An underprivileged connection cannot be elevated by runas; the connection account must already be an Administrator. Results also depend on token privileges, the Secondary Logon service, and logon-right settings. If runas fails, verify those host prerequisites before changing playbook syntax.
Constrain sudo and delegated-access policies
Organizations sometimes restrict sudo, pbrun, or doas to approved command paths. A module may then fail even though the user can log in successfully. The Ansible documentation recommends either a special account without that command-path constraint or centralized access management through AWX or Red Hat Ansible Automation Platform for indirect SSH-credential use.
Whichever model you choose, grant only the commands and hosts required by the play. Separate deployment identities from general administrator identities, review policy changes, and retain job logs that show which account and method were selected without recording the secret itself.
Keep playbooks understandable and lintable
When a task changes users, make the escalation intent visible next to that task or at the play level. Ansible Lint’s partial-become rule checks that escalation is activated when users are changed. The rule does not evaluate inherited play-level or command-line values, so a clean lint result does not prove that an external setting is correct. Review the effective command-line and inventory configuration as part of deployment testing.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Prefer explicit names and comments for unusual targets:
- name: Rebuild cache as the application account
ansible.builtin.command: /usr/local/bin/rebuild-cache
become: true
become_user: appsvcThis makes the intended identity auditable and reduces the chance that a later maintainer mistakes a service-account operation for a root operation.
A practical pre-run checklist
- Confirm the remote connection user and the intended target user separately.
- Enable escalation with
become: true; do not rely onbecome_useralone. - Select a method supported by the host and connection plugin.
- Use task scope unless the whole play genuinely needs elevation.
- Test authorization for the exact command or module action.
- Use
-Konly when an interactive password prompt is appropriate. - Protect stored passwords with Ansible Vault or a centralized credential manager.
- Check temporary-module permissions when both users are unprivileged.
- Leave
world_readable_tempdisabled unless the exposure is understood and accepted. - For Windows, verify Administrator membership, Secondary Logon, token privileges, and logon rights.
- For network devices, verify enable-mode support in the selected connection plugin.
- Inspect lint findings and the effective inventory, play, and command-line precedence.
Bottom line
become is Ansible’s privilege-escalation switch; become_user is the identity selector. Use them together, at the smallest useful scope, with a method that the connection plugin supports. Treat password prompting, Vault storage, temporary module permissions, and platform-specific authorization as part of the design—not as troubleshooting afterthoughts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
