Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have sudo set up for a user (myuser) as follows on "hostname" (sudoers content):

Cmnd_Alias SCRIPT=/path/script*
myuser ALL=(suser) NOPASSWD: SCRIPT

this works fine, so I can run the following, logged in locally as myuser on hostname, without need for password:

sudo -u suser /path/script

however, when I use ssh (with keys set up, so no password required) to login and run, as follows:

ssh hostname sudo -u suser /path/script 

I get prompted for a password, and when the password is entered I get:

Sorry, user myuser is not allowed to execute '/path/script' as suser on hostname
.

UPDATE The problem is solved by removing the "*" from the end of the command in sudoers. The * was added to allow parameters to be passed to script, but actually doesn't appear to be necessary. Still don't understand why the * allows the sudo to work locally, but not over ssh. So question still stands

share|improve this question
    
Are you logging into an SSH server that requires password authentication? –  Somantra Jun 27 '12 at 16:06
    
no, I have keys set up –  Joe Watkins Jun 27 '12 at 16:11
    
In your sudoers file, did you use the ALL keyword? You may want to try an ALL=ALL config just to identify the root cause. user ALL=(ALL) ALL NO PASSWD: ALL If that config works, and it should, then the remaining task is just paring back the permissions to the appropriate level. –  Somantra Jun 27 '12 at 16:22
    
when you get asked for a password, if you supply it does the command work ok ? –  Iain Jun 27 '12 at 17:15
    
@Iain - no, it says my user is not allowed to execute the script as user on hostname –  Joe Watkins Jun 27 '12 at 17:27
show 14 more comments

2 Answers 2

You didn't specify a host in the sudoers, so it only works locally as you have it setup now.

So if you set the host parameter to ALL, it will work on any host.

From man sudoers:

The reserved word ALL is a built-in alias that always causes a match to succeed. It can be used wherever one might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias, or Host_Alias.

...

By default, if the NOPASSWD tag is applied to any of the entries for a user on the current host, he or she will be able to run sudo -l without a password. Additionally, a user may only run sudo -v without a password if the NOPASSWD tag is present for all a user's entries that pertain to the current host. This behavior may be overridden via the verifypw and listpw options.

The additional fact that the following works at the terminal seems to bear out that the host is the reason you get prompted.

$ ssh hostname

$ sudo -u user /path/script

share|improve this answer
    
OK, I'll have a word with sysadmin, and try to change. Thanks –  Joe Watkins Jun 27 '12 at 16:56
    
The output of sudo -l which the OP posts doesn't show the hostname portion of the spec from the sudoers file. –  Iain Jun 27 '12 at 17:02
    
I only need to run this on one host - so can that host get specified in the sudoers file? (rather than ALL) –  Joe Watkins Jun 27 '12 at 17:05
    
@Lain, it is true that that the sudo-l shows info for the current host only, still seems to be behaving that way though. –  Somantra Jun 27 '12 at 17:07
2  
If you try to specify an sudoers entry without a hostname or Host_Alias then visudo will not save the file. Like me you have been misdirected by the OP not saying that the apparent sudoers line above was generated by sudo -l. –  Iain Jun 27 '12 at 17:11
show 4 more comments

The syntax you are showing for the sudoers file is incorrect and visudo won't let you create a file with that syntax. It should be something like

testuser hostname=(user) NOPASSWD: /path/script*

Using this syntax I can ssh to hostname and execute a script without eing asked for a password.

EDIT

From reading the comments it seems that there is an misconfiguration in your sudoers file. This would appear to be something to to with the Host_Alias or hostname specification part of the line.

I've set up a testuser on a CentOS 6 system and tried various configurations and can't find one that works when I'm logged in locally but denies me access when trying via ssh.

share|improve this answer
    
I don't have access to the sudoers file. I'm showing the output of sudo -l. The sudo works fine with no password prompt when run locally. –  Joe Watkins Jun 27 '12 at 16:39
    
Ah, right - I wish you'd said that in your question. –  Iain Jun 27 '12 at 16:47
    
amended question so hopefully all the relevant facts are now in it –  Joe Watkins Jun 28 '12 at 14:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.