Capistrano using sudo even with "set :use_sudo, false"

Question

I do not wish to use sudo for any of my remotely executed commands via Capistrano. Specifically, when I run cap deploy:setup, I'm asked for my sudo password during the first mkdir command. I added set :use_sudo, false to my deploy.rb file, but this did not make a difference.

I started with a fairly complete deploy.rb file, but whittled it down once I started having issues. Here is my minimal version that still shows use_sudo not being respected:

# App Definitions

set :domain, '[server-ip]'
role :app, domain
role :web, domain
role :db, domain, :primary => true

set :user, "my_app"
set :use_sudo, false

task :sudo_test do
  run "#{try_sudo} whoami"
end

running cap sudo_test results in me being prompted for my sudo password. What am I missing here (besides the hair I've already pulled out)?

Google Findings

https://groups.google.com/forum/?fromgroups#!topic/capistrano/QNYnvW8obrg

A thread with someone having a similar issue. No conclusion/resolution noted in the thread.

Corotto

what is that #{try_sudo} bit? what if you take it out? – Filagree

#{try_sudo} should sudoize the command if :use_sudo is set to false. I include it in sudo_test because the capistrano rails tasks likely use it as well, and is likely where the problem stems from. – Corotto

We use 'sudo -i <cmd>' in our deploy.rb file. – Birnbaum

and this too: sudo 'aptitude install -y rsync' – Birnbaum

As mentioned above, the initial reason for the post is that cap deploy:setup is trying to use sudo when I don't want it to. cap deploy:setup is a pre-baked recipe; I'm not looking to modify it. Rather, I need to determine why the option :use_sudo isn't working. – Corotto

Are you sure it's prompting for your sudo password rather than your SSH password? I tried your setup and it's prompting for my SSH password. – Cheesewood

@JeroenRosenberg You are seeing that because you haven't set up ssh key authentication. Mine is related to sudo. – Corotto

Answer 1

Apparently, it is not possible to disable sudo functionality with certain capistrano tasks. The assumption is that the unprivileged user on the server should not be able to carry out certain tasks.

The command in question is mkdir. I'd argue that an unprivileged user should be able to run this command if the parent folder is one that they have permission to do so for. I'd also argue that the user may in fact be a privileged user, such as root. Best practice? Not necessarily. Within the realm of reason for certain deployments, yes.

Here is the link to the response to my original question:

https://github.com/capistrano/capistrano/issues/211#issuecomment-7667467

Corotto

:use_sudo, false worked for me with mkdir (using deploy:setup) – Penley

Answer 2

For anyone else who runs into this issue and is a fool like me. Make sure you arn't quoting false. I had:

set :use_sudo, "false"

and when I switched it to

set :use_sudo, false

most things started working the way I expected. As YWCA Hello points out there are still commands that ignore the use_sudo setting. However, don't forget to set it correctly.

Nirvana

As an explanation (without reading the relevant part of the capistrano code): "false" is a true-ish value in ruby. Only nil and false are false-ish. Any other value, incl. 0, "", [], are considered true. So setting :use_sudo to "false" is the same as setting :use_sudo to true. – Monocot