A PHP program I am working with (LConf) calls a script using
I have allowed the user
apache to run the script and have tested with
sudo -u apache /usr/local/LConf/lconf_deploy.sh.
I am being prompted for a password when
/usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v, but have no problems calling lines before or after this line.
After reading a lot (both on stackexchange and elsewhere on the internet) about what to do in this situation, I have disabled
requiretty and used
NOPASSWD for everything I can think of that affects this situation.
# cat /etc/sudoers | grep -v "#" Defaults always_set_home Defaults env_reset Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS" Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin root ALL=(ALL) ALL apache ALL = NOPASSWD: /usr/local/LConf/lconf_deploy.sh apache ALL = NOPASSWD: /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v apache ALL = NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v icinga ALL = NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
Is it possible to switch user context (or whatnot) using
sudo, while already "
If not, how do I solve this problem? Note that
/usr/local/LConf/LConfExport.pl must be run as the user
[updated with reference to mdpc's comment below]
User_Alias LCONF=apache,icinga Defaults:LCONF !requiretty LCONF ALL=(icinga) NOPASSWD: /usr/local/LConf/LconfExport.pl -o /etc/icinga/lconf -v LCONF ALL= NOPASSWD: /usr/local/LConf/lconf_deploy.sh
sudo -u apache /usr/local/LConf/lconf_deploy.sh. still prompts for password
# cat /usr/local/LConf/lconf_deploy.sh echo start of script /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v /etc/init.d/icinga reload # sudo -u apache /usr/local/LConf/lconf_deploy.sh start of script [sudo] password for apache: Running configuration check.../etc/init.d/icinga: line 111: /var/icinga/icinga.chk: Permission denied CONFIG ERROR! Reload aborted. See /var/icinga/icinga.chk for details.
Any assistance is appreciated.