Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A PHP program I am working with (LConf) calls a script using sudo.

I have allowed the user apache to run the script and have tested with sudo -u apache /usr/local/LConf/lconf_deploy.sh.

I am being prompted for a password when lconf_deploy.sh calls /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v, but have no problems calling lines before or after this line.

After reading a lot (both on stackexchange and elsewhere on the internet) about what to do in this situation, I have disabled requiretty and used NOPASSWD for everything I can think of that affects this situation.

# cat /etc/sudoers | grep -v "#"
Defaults    always_set_home
Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
root    ALL=(ALL)       ALL
apache ALL = NOPASSWD: /usr/local/LConf/lconf_deploy.sh
apache ALL = NOPASSWD: /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
apache ALL = NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
icinga ALL = NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v

Is it possible to switch user context (or whatnot) using sudo, while already "sudoing"?

If not, how do I solve this problem? Note that /usr/local/LConf/LConfExport.pl must be run as the user icinga.

Thanks,

Matt

[updated with reference to mdpc's comment below]

   User_Alias      LCONF=apache,icinga
   Defaults:LCONF !requiretty
   LCONF ALL=(icinga) NOPASSWD: /usr/local/LConf/LconfExport.pl -o /etc/icinga/lconf -v
   LCONF ALL= NOPASSWD: /usr/local/LConf/lconf_deploy.sh

Executing sudo -u apache /usr/local/LConf/lconf_deploy.sh. still prompts for password

   # cat  /usr/local/LConf/lconf_deploy.sh
   echo start of script
   /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
   /etc/init.d/icinga reload
   # sudo -u apache /usr/local/LConf/lconf_deploy.sh
   start of script
   [sudo] password for apache:
   Running configuration check.../etc/init.d/icinga: line 111: /var/icinga/icinga.chk:      Permission denied
   CONFIG ERROR! Reload aborted. See /var/icinga/icinga.chk for details.

Any assistance is appreciated.

share|improve this question

3 Answers 3

This line:

 apache ALL = NOPASSWD: /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v

will not work. It will invoke sudo as apache, and that is not right.

What you probably want is:

  apache ALL=(icinga) NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
share|improve this answer
    
I'll test this and let you know! Thanks for the info. –  mbrownnyc Aug 15 '12 at 17:43
1  
NOTE: You'll still have to invoke the sudo command while running the command as the apache user as: /usr/bin/sudo -u icinga /usr/local/LConf...... –  mdpc Aug 15 '12 at 17:50
    
This did not work. I've updated the question with relevant part of visudo. –  mbrownnyc Aug 15 '12 at 19:08
    
You have made a spelling mistake, in the script LConf in sudo Lconf. If you copied my original line I made the same typos (which have been corrected). Sorry about that. –  mdpc Aug 15 '12 at 20:18
    
Corrected in /etc/sudoers and the original post. Problem persists any ideas: [sudo] password for apache: I have a feeling it's the calling of sudo -u icinga inside of the bash script that's the problem. How can I verify that the environment is solid for sudoers to be accessed or what not? –  mbrownnyc Aug 15 '12 at 20:39

Type

su - apache

Then

/usr/local/LConf/lconf_deploy.sh

If first command does not work type :

su - apache -s /bin/bash
share|improve this answer
    
Thanks for the reply, Eric. I'd be executing the command via apache, since it is actually executing a shell script from some PHP code (that I don't control). So there will be no interaction with the shell. –  mbrownnyc Aug 15 '12 at 21:00
up vote 0 down vote accepted
   == mbrownnyc [266b4002@gateway] has joined ##linux
   -ChanServ- [##linux] Welcome to ##Linux! Can't speak? Please see http://linuxassist.net/irc on how to register or identify your nick. By joining this channel you agree to abide by the channel rules and guidelines stated on the official ##Linux website http://www.linuxassist.net/rules .
   <loomsen> there are different ways to solve this, but all of them are ugly and        discouraged
   <loomsen> mbrownnyc, you could add apache to the icinga group, make that script ug+x and set a sticky bit
   <nb-ben> mbrownnyc, you should take a look at suEXEC for php

   <koala_man> mbrownnyc: works fine: http://pastebin.com/JhefHzCh
   <koala_man> mbrownnyc: I still think you're just confusing your users
   <koala_man> mbrownnyc: you add permissions for apache to run lconf_deploy as        root, and then test using your icinga user
   <koala_man> to run it as apache

Solution:

   # cat /etc/passwd | grep icinga
   icinga:x:499:500:icinga:/var/icinga:/bin/false
   # cat /etc/passwd | grep apache
   apache:x:48:48:Apache:/var/www:/bin/false

   # grep -v "#" /etc/sudoers
   Defaults    !requiretty
   Defaults   !visiblepw
   Defaults    always_set_home
   Defaults    env_reset
   Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
   Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
   Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
   Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
   Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
   Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
   root    ALL=(ALL)       ALL

   User_Alias      LCONF=apache,icinga
   Defaults:LCONF !requiretty

   LCONF ALL=(apache) NOPASSWD: /usr/local/LConf/lconf_deploy.sh
   LCONF ALL=(icinga) NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v

   # cat /usr/local/LConf/lconf_deploy.sh
   #!/bin/bash
   echo start of script
   sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
   /etc/init.d/icinga reload
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.