Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possibile to configure sudo to ask for root password instead of user password?

The server is configured with a root user and a simple user (let's call him simple) with limited privileges, used to deploy all the applications hosted on the server. The user simple is not in the sudoers list thus

$ sudo command

won't work because simple's password can't grant him root privileges.

Occasionally I need to run some scripts which need root access via Capistrano (a ruby deployment tool) and it's quite difficult to code a script in order to login as root, run the script, then logout. I'd like to be able to execute the following statement

$ sudo god restart tasks-group

and have Capistrano to prompt me for root password. Currently, Capistrano prompts for deployment user password which is, obviously, a non admin account.

share|improve this question

4 Answers 4

up vote 11 down vote accepted

I think you're trying to make sudo work in a way that it is not ment to - you don't want to add the 'simple' user to the sudoers file (please correct me if i'm wrong).

In that case sudo isn't the tool you want to use you want to issue su -c <command> this will prompt for the root password, execute the command, then exit.

share|improve this answer

There's a flag to be set in the sudoers file if you want the user to authenticate via his own password, or via root's. The flag is called rootpw. Sudo is a very powerfull package, be sure to check the man page about sudoers(5).

share|improve this answer
2  
See also information in man sudoers regarding targetpw and Runas. –  Dennis Williamson Jan 18 '10 at 23:38

No. Use su to become root using the root password.

The better solution is probably to have capistrano use sudo on the deployment machine for tasks that need root access.

share|improve this answer
    
This requires the user to be included in the sudoers list. I wanted to avoid this configuration because the user can login from ssh. –  Simone Carletti Jan 18 '10 at 21:17
3  
But on the other hand you can add just the relevant commands to sudoers, thus limiting what the non-admin user can do. I think that this, on the whole, is more secure than involving the actual root password. –  Jakob Borg Jan 18 '10 at 21:28

If the deployment user is allowed to sudo, then at that point it does become a privileged account that can act in an administrative fashion. That's the purpose of sudo. Or am I misreading the question?

share|improve this answer
    
This is the point. The deployment user is not in the sudoers list. –  Simone Carletti Jan 18 '10 at 21:16
    
Ok. You might want to edit that into your question, then. Sorry, was't clear (at least to me). –  squillman Jan 18 '10 at 21:22
    
Updated. Sorry for the misunderstanding. –  Simone Carletti Jan 18 '10 at 21:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.