3

I'm trying to grant the www-data group access to certain commands under sudo (ie to restart Apache) and I'm having no luck. I spent the majority of Friday looking into this issue and must have looked at 20 forum posts, and SO/SF threads pertaining to the issue with no luck.

Following is my sudoers file (edited via visudo).

#
# This file MUST be edited with the 'visudo' command as root
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.

Defaults        !requiretty
Defaults        env_reset
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:$

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# Allow members of www-data group access to apache
%www-data ALL= NOPASSWD: /usr/bin/service apache2 *

# See sudoers(5) for more information on "#include" directive

If I log in as my jenkins user (which is part of the www-data group as shown below);

root@ip-REDACTED:~# groups jenkins
jenkins : www-data jenkins

I am unable to run "sudo service apache2 restart" as seen below.

jenkins@REDACTED:/root$ sudo service apache restart
[sudo] password for jenkins: 
jenkins is not allowed to run sudo on ip-REDACTED.  This incident will be reported.

Jenkins is not part of the sudo group, but I don't want it to be as then it will have access to everything. Also, it doesn't seem to be picking up on the NOPASSWD flag that has been set in sudoers. I've tried everything I can think of at this point and am coming up blank. It might be worth mentioning that this is running on an EC2 instance, does EC2 place any additional restrictions on what can be done with the sudoers file?

Thanks in advance.

1 Answer 1

1

Try a Cmnd_Alias definition instead:

Cmnd_Alias  APACHE_CMD = /usr/sbin/service apache2 restart
%www-data   ALL = (root)NOPASSWD: APACHE_CMD

Make sure the path to the service executable is correct.

You can check also the sudoers definition in your /etc/nsswitch.conf file, and make sure it contains a files attribute:

sudoers:  files ldap sss
1
  • I don't have the reputation to vote this answer up, but thank you so much! My predecessor must have removed the files attribute from /etc/nsswitch.conf. I added that line in (and amended the sudoers file as you suggested, makes sense placing it into Cmnd_Alias) and all is good in the world again. Sep 30, 2013 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .