Vagrant: provision as different user than config.ssh.username

[lexinator]

My goal is to 'vagrant ssh' as my login name and mount my home directory over nfs.

nfs-kernel-server does not support uid mapping so /etc/passwd uid must match my home directory ids. I cannot pre-populate a single vagrant box with all my colleague accounts, as the default uid for the first account on a mac is 501.

I would like to change "config.ssh.username" to my login but I cannot until after the new account is provisioned.

I think the best approach that I've come up with is to be able to provision as the "vagrant" user.

my current work around is in the provision step to modify ~vagrant/.bashrc to ssh mynewlogin@localhost. It works but is not ideal.

[logicminds]

+1 I have a similar request where I want puppet apply to run as a non-root user.

[7even]

The ability to provision as the vagrant user would be really cool.

[lexinator]

7even: vagrant already uses vagrant user(config.ssh.username) for provisioning. this request is to use separate provision user from ssh user.

[7even]

Yes, I also meant that - to provision as vagrant user (as with default config.ssh.username) but login via vagrant ssh as my own user (which doesn't exist yet when provisioning for the first time).

[mitchellh]

The shell provisioner now supports doing this and the Puppet provisioner will have it soon (tracked in another issue).

[lexinator]

Great! Where's the corresponding commit/documentation?

[mitchellh]

1370

[lexinator]

Perhaps I'm missing something big here but, I don't see how #1370 resolves this issue.

[mitchellh]

Ah sorry, I didn't read this totally right. Even so, I don't want to support arbitrary users. It is easy enough to provision as root (default) and then do a su -u and execute as any user you want.

[lexinator]

i tried using su but couldn't due to subtle things like the tty/ssh-agent pipe being owned by the initial user. My workaround is to ssh again as the newuser@localhost, which is why I opened this bug in the first place.

If I'm understanding correctly, it's not easy to provision as vagrant user, and ssh as a different user?

[mitchellh]

Vagrant has all the same problems as you if it were to su. The reason forwarding agents doesn't work with su is because you must presere the SSH_AUTH_SOCK env var. And Vagrant doesn't use a tty so you'd have to request that, as well.

[lexinator]

i think you may be misunderstanding me.

My goal is to have all vagrant commands use user "vagrant" and "vagrant ssh" use my username.

[mitchellh]

Ah, sorry. You can do that with both the shell and puppet provisioners now. With vagrant ssh you can just do vagrant ssh-config and change the user info as you see fit.

[dghubble]

An example is needed here. You're proposing the asker do the following:

vagrant ssh-config > myconf
# modify myconf to have the desired username
ssh -F myconf default

This works, but I think the asker had a legitimate feature request for a nicer solution than this.

[lexinator]

Since then I have thought of an alternate solution to avoid the double ssh is to use a shell alias/function: vagrant ssh <host> -- -l $USER Though this is less flexible as I have to ask my users to do extra work to use the Vagrantfile, so my double ssh solution is good enough.

[nicolasFlinois]

Same need here: I would like use standard boxes (vagrant/root accounts only) to provision, but setup another ssh login for vagrant ssh. (the aim is to provide ready-to-use dev-boxes with the right login for users).

[danielfrg]

Because the Vagrantfile is a ruby file (an amazing idea btw, i have been doing that since i saw vagrant do it) there is a very simple solution for this:

VAGRANT_COMMAND = ARGV[0]

Vagrant.configure("2") do |config|
  if VAGRANT_COMMAND == "ssh"
      config.ssh.username = 'other_username'
  end

  ...
end

So when you do vagrant ssh its going to use other_username but when you do vagrant provision it will still use the default vagrant user.

[lexinator]

nice! i like the solution. thanks

[ldong]

@danielfrg Thanks.

provision is running root by default, this should be written in the doc more clearly.

[lexinator]

@ldong For most provisioning backends it defaults to using sudo however some(all?) can be disabled. For example the shell provisioner has an option privileged to disable running as root. https://docs.vagrantup.com/v2/provisioning/shell.html