Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to configure my Debian box sudoers file as follows:

  • If USERNAME is remoted in from IP a.a.a.a: No password is needed to use sudo
  • If USERNAME is remoted in from anywhere else or local: A password is needed to use sudo

I know how to make it so they are always needed, or never needed, but I do not know how to configure for the multiple locations.

share|improve this question
I am pretty certain that that is not possible. – Ryan Matthews Dec 20 '11 at 21:28
What is the end goal here? As I don't think what you want to do will be possible. – jeffatrackaid Dec 20 '11 at 21:54

I think you misunderstand the purpose of host list in the sudoers file. It exists so you can use the same file on multiple hosts while not allowing the same rights on every host.

Instead, you should use ssh keys to allow passwordless login as root. You can create two keys for the user in question. Make one of the keys encrypted with a passphrase, and keep the other one clear text. On your server, put the public keys into root's .ssh/authorized keys file. Then prepend from="a.a.a.a" to the passwordless public key's line to prevent anyone from using it from another host.

This requires you to allow root login over ssh, but you should only allow root login with ssh keys. Make sure your sshd_config has the following setting:

PermitRootLogin without-password
share|improve this answer
If I follow, this would require a person to SSH to root directly versus using a non-priv user account and then using sudo. This works but requires permitting SSH to allow a root login. The OP's method (though I don't think possible) would not require SSH to permit a root login. – jeffatrackaid Dec 20 '11 at 21:53
This is true. I never allow ssh logins to root with a password. I will update the answer with more instructions. – Jeff Strunk Dec 20 '11 at 22:13

I'm not certain if there is already a module that will do this, but you can definitely accomplish this with the PAM system.

A module that confirms that the user is logged in via ssh & is using the correct IP can be entered into the sudo config with the sufficient line and it will grant access.

I would take a look at the sample one from and possibly go from there or use pam_rhosts as a sample.

requisite authorized_user #sudoers file / existing module?
sufficient via_ssh_from_listed_host
required password #usual sudo thing

That's the desired module pattern.

share|improve this answer
Looking into that. Ill post back here when I figure out a solution. – mrkmg Dec 22 '11 at 18:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.