Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a fabric deployment script which uses sudo heavily. It runs about 20 commands using sudo without any problems and then choke on the last two commands:

ln -sf /path/a /path/b
chown -R someuser:somegroup /path/a

When my script tries to run one of these commands, I get the sudo password prompt (even though the script already used sudo about 20 times just before without asking for it).

Now if I ssh to the server and type the command with sudo, I get the same result. It prompts me for the my password. The problem is that it never accept it.

So if I type sudo with any other commands it works. But with these two commands it keeps asking me for my password and refuse it saying "Sorry, try again.". However if I log in as root with su and type the same command it works.

So the password is correct and sudo works (except for those two commands) and this is not related to fabric .. I'm out of ideas.

My sudoers conf looks like this:

root    ALL=(ALL)       ALL
myuser  ALL=(ALL)       ALL

I don't know where to look anymore.

ls -l output:

Matching Defaults entries for myuser on this host:
    requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User myuser may run the following commands on this host:
    (ALL) ALL

Update

With some help from the CPanel tech support, I'm narrowing down the source of my problem..

The source of the problem seems to be CPHulk, a CPanel brute force protection module.

Since this module as an IP whitelist setting, I've added my IP to it. But it didn't solve my problem since CPHulk doesn't seem to see my IP:

$ tail -f /usr/local/cpanel/logs/cphulkd.log
[info] Connection service=system ip= port=0 user=myuser blocked by cphulkd (Too many failures for this username numfailed=17 max=15)

Notice the "ip" field is blank. I've seen other users getting blocked and their IP is always displayed.

Now I guess I'll have to find out why CPHulk doesn't see my IP..

Update 2

According to the CPanel it's not possible to whitelist by username, so I'm pretty much stuck.

The only possible workaround I've found is to disable CPHulk before running the script and reactivate it after.

By chance, my deployment script support hooks which can run command before and after the deployment is done. So I only have to associate these two commands to the right hook:

/usr/local/cpanel/bin/cphulk_pam_ctl --disable
# Usual deploy script here
/usr/local/cpanel/bin/cphulk_pam_ctl --enable
share|improve this question
    
please provide a sudo -l output –  jfried Aug 28 '12 at 18:54
    
I updated my post with ls -l output –  h3. Aug 29 '12 at 13:26
2  
This question appears to be off-topic because it concerns the use of shared web hosting by end users or resellers, rather than the administration of web hosting. –  Falcon Momot Jul 2 '13 at 3:11
add comment

1 Answer

IF you really want no password prompting

myuser ALL=(ALL) NOPASSWD: ALL

That said I STRONGLY ADVISE replacing NOPASSWD: ALL with NOPASSWD: a,limited,subset,of,commands

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.