Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OS: CentOS 5.5

I have a 2 users which are part of a group. I would like to allow that group to be able stop and start Apache, but not grant access as root.

I have been looking at the Sudoers approach but I understand this will fail as a process trying to listen on ports between 1 - 1024 requires root access.

Could anyone suggest a solution?

Thanks in advance

share|improve this question
up vote 4 down vote accepted

With sudo you can give fine grained elevated access to your users. Write a small script that does exactly what you want your users to be able to do. Set the file permissions on the script so that your users cannot edit it. Then grant your users access to run just the script via sudo. Then add a line like below for each user into the sudoers file with the visudo command

usera ALL = (ALL) /path/to/script


The script can be as simple as

/usr/sbin/apachectl restart

Make the ownership of the script root:root and the permissions 500.

share|improve this answer
Wont this still have the permission problem? – Lee Feb 14 '11 at 13:10
Shouldn't be a problem as you are only granting permission to run the script as root. – Iain Feb 14 '11 at 14:12
+1 for same first name spelling. (and seemingly sound advice) – iainlbc Feb 14 '11 at 17:27
with permissions 500, the user wont be able to execute it? – Lee Feb 15 '11 at 14:23
@Lee: using sudo the script is executed as root sudo /path/to/script . The user's cannot make changes so it's safe. – Iain Feb 15 '11 at 16:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.