Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a deploy user. I'm trying to make it to execute some operators without using sudo that i could enter a password for.

here's my visudo:

# /etc/sudoers
# This file MUST be edited with the 'visudo' command as root.
# See the man page for details on how to write a sudoers file.

Defaults        env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL

# Uncomment to allow members of group sudo to not need a password
# (Note that later entries override this, so you might need to move
# it further down)
# %sudo ALL=NOPASSWD: ALL
%team   ALL=(ALL)     ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# ubuntu user is default user in ec2-images.
# It needs passwordless sudo functionality.
ubuntu  ALL=(ALL) NOPASSWD:ALL

Cmnd_Alias DEPLOY= /home/deploy/.rbenv/shims/foreman, /sbin/start, /sbin/stop, /sbin/restart, /bin/mv
deploy ALL=(ALL) NOPASSWD:DEPLOY

and here's where deploy belongs:

ec2 ~: groups deploy
deploy : deploy team

I tried mv to move some file to /etc and it did't work.

I'm on Ubuntu 10.04 LTS 64bit.

Thanks!

share|improve this question
6  
Do you really need to permit arbitrary moving of files on the filesystem? Are you sure this cannot be handled by filesystem permissions? What would prevent an evil person from just doing a sudo mv /tmp/blah /etc/sudoers? If you are going to permit arbitrary file manipulations, you might as well give up, and just permit anything. –  Zoredache Oct 20 '11 at 19:44
    
Sooo... what's the problem? Can you show the command you ran and the result? –  MikeyB Oct 20 '11 at 19:49
1  
By the way, did you mean 'sudo without sudo' or 'sudo without password'? –  MikeyB Oct 20 '11 at 19:50
2  
You generally don't want to give someone sudo access to /bin/mv - since that's a huge security risk. Giving them sudo access to a script that does the entire task is a lot safer (it's not OK if you give them access to edit said script). –  Kvisle Oct 20 '11 at 19:58
1  
On that note, giving them sudo access to a script in their home directory really means 'sudo access to EVERYTHING'. –  MikeyB Oct 20 '11 at 20:01
show 1 more comment

closed as off-topic by Jenny D, Ward, Dave M, mdpc, Falcon Momot Oct 8 '13 at 5:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – Jenny D, Ward, Dave M, mdpc, Falcon Momot
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

mv xxx /etc

Even if you specify what you did in your /etc/sudoers file, you still need to run sudo in your mv command.

But what you should be doing is allowing deploy to run a specific script that does the mv operation, but not allowing arbitrary mv commands.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.