title: Configuring a server with Ansible using root account or not?
body: <p>As a common security habit, I learned that you shouldn't allow root login through ssh on machines open to the world. The way to go is to ssh to your server with a user account, then use sudo. Also Ubuntu disabled ssh-ing as root account by default.</p>
  
  <p>When I'm configuring a server manually I usually execute <code>sudo -i</code> to have a persistent root shell, so that I don't have to type <code>sudo</code> in front of every command.</p>
  
  <p>Now I'm not completely sure what's the best way to do it with Ansible. In Ansible's inventory files, you can specify the user to use for ssh-ing with the <code>ansible_ssh_user</code> variable. In Ansible playbooks and tasks you have these options:</p>
  
  <ul>
  <li>remote_user - The user to ssh to the machine with for the specific playbook/task</li>
  <li>sudo - If <code>yes</code>, runs the commands in the playbook/task with sudo</li>
  <li>sudo_user - Sudo to a different user and then execute the commands in the playbook/task</li>
  </ul>
  
  <p>So I specified the user I use for ssh-ing with <code>ansible_ssh_user</code> and then I have a couple of tasks that need root privileges.</p>
  
  <p>I have a two of options to do this, but I don't really like them:</p>
  
  <ol>
  <li><p>I could use <code>sudo: yes</code> for every single task that needs root privileges.</p>
  
  <p>I don't really like this way because I will have to use this for almost every task.</p></li>
  <li><p>I could put <code>sudo: yes</code> in the playbook that includes the roles/tasks.</p>
  
  <p>I doubt if this should be the correct way, because like this, all roles/tasks should assume that they always have root privileges. Also, if we would do it like this, why can't I then just set this as an option in the Ansible config, so that all my playbooks (and it's roles/tasks) will always use sudo?</p></li>
  </ol>
  
  <p>So I wonder, what is the correct way to do this?</p>