How can emacs org-mode execute shell code remotely as sudo?

Question

My self-documenting maintainance scripts, where I document how systems have been setup, I need to execute stuff as sudo/root and want the results automatically added to the document. But for safety reasons on the target system root has login disabled. I have to connect via an admin-user, which then can sudo stuff.

in my emacs init.el this adds bash execution:

;; allow org mode bash execution
;; --------------------------------------
(org-babel-do-load-languages 'org-babel-load-languages '( (shell . t ) ) )

Then in my document I have e.g. this bash / shell piece:

#+BEGIN_SRC bash :dir /sudo:adminuser@fresh_installed_computer:~/ :results output 
parted /dev/sda "unit GiB" "print free"
parted /dev/sda "unit s" "print free"
#+END_SRC

The error message is:

Host 'fresh_installed_computer' looks like a remote host, 'sudo' can only use the local host.

See Org-Mode Manual: 15 Working with Source Code

Using Debian Stretch with Emacs 24.5.1 on the local machine, the remote machine is about to become debian buster fresh install.

---

UPDATE

When executing

#+BEGIN_SRC bash :dir /ssh:adminuser@fresh_installed_computer|sudo:fresh_installed_computer:~/ :results output :session 
echo "user $USER" 
#+END_SRC 

The status line holds "Opening connection for root@fresh_installed_computer using sudo... \" and then waits forever

Interestingly: when I add the actual IP address like this, it suddenly works as expected:

#+BEGIN_SRC bash :dir /ssh:adminuser@fresh_installed_computer|sudo:XXX.XXX.XXX.XXX:~/ :results output :session 
echo "user $USER" 
#+END_SRC
#+RESULTS:
: user root 

ssh to adminuser@fresh_installed_computer and there pinging works, so name resolving is up.

ping fresh_installed_computer

Any explanation, or do I need to stick with magic number fixed ip adress in my document?

---

UPDATE 2

The issue with resolving hostname vs IP adress could be solved by clearing tramp proxy caches:

M-x tramp-cleanup-all-connections
M-: (setq tramp-default-proxies-alist nil)

Now all works fine! Thx

Answer 1

Use TRAMP multi-hop syntax for :dir header.

4.4 Combining ssh or plink with su or sudo

If the su or sudo option shall be performed on another host, it could be comnbined with a leading ssh or plink option. That means, TRAMP connects first to the other host with non-administrative credentials, and changes to administrative credentials on that host afterwards. In a simple case, the syntax looks like /ssh:user@host|sudo:host:/path/to/file.

:dir /ssh:user@fresh_installed_computer|sudo:adminuser@fresh_installed_computer:~/

Tip: Adding :session header to code block can be helpful too.

#+BEGIN_SRC bash :dir /ssh:user@fresh_installed_computer|sudo:adminuser@fresh_installed_computer:~/ :results output :session 
parted /dev/sda "unit GiB" "print free"
parted /dev/sda "unit s" "print free"
#+END_SRC

---

Note: If the goal is to login as adminuser and then sudo to root user the tramp connection string would be updated this way instead.

:dir /ssh:adminuser@fresh_installed_computer|sudo:fresh_installed_computer:~/

#+BEGIN_SRC bash :dir /ssh:adminuser@fresh_installed_computer|sudo:fresh_installed_computer:~/ :results > output :session 
parted /dev/sda "unit GiB" "print free"
parted /dev/sda "unit s" "print free"
#+END_SRC

Thanks to NickD for pointing this out!

---

Don't use ...|sudo:localhost: -- that's once again going to create a dangerous proxy on Emacs versions < 27

Thanks to phils for pointing this out!