Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

The following /etc/sudoers entry worked under Mac OS 10.7, but prompts for a password under 10.8:

username ALL=NOPASSWD:/usr/libexec/dovecot/deliver

I assume that Apple upgraded to a newer sudo; the version under 10.8 is 1.7.4p6, which still doesn't seem to be that up-to-date. Unfortunately, every site that appears to have a changelog for sudo is unreachable right now.

Could somebody point me to the correct syntax to allow user username to run deliver via sudo without providing a password on Mac OS 10.8? This change is preventing any email from being delivered via procmail, which is not 100% ideal!

share|improve this question
Since you seem to know the problem is just a syntax change, did you check the man page? – Aaron Copley Sep 27 '12 at 17:10
1  
Yes; unfortunately, the manual page isn't exactly written for easy reading. "Whitespace between elements in a list as well as special syntactic characters in a User Specification ('=', ':', '(', ')') is optional" is about the only bit that jumps out unless you like manually parsing EBNF grammars. Otherwise you have to infer it from the fact that there are spaces in the examples that weren't there before… – John Yeates Sep 27 '12 at 17:18
I hate that. Glad you found the quick fix! – Aaron Copley Sep 27 '12 at 17:23

2 Answers

up vote 2 down vote accepted

And, after typing all that, a bit more experimentation gives:

username ALL = NOPASSWD: /usr/libexec/dovecot/deliver

Not sure when spaces started being required…

(Advanced students will also have noticed that deliver is now called dovecot-lda, and lives in /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot rather than /usr/libexec/dovecot!)

share|improve this answer
Be sure to mark your answer as accepted! – Aaron Copley Sep 27 '12 at 17:22
up vote 1 down vote

I too could not get the NOPASSWD keyword to work on Mac OS X 10.8.x. It always required that I enter my password. As it turns out this was due to multiple matches for the username with the NOPASSWD specification.

my sudoers file had:

admin1  ALL=(ALL) NOPASSWD: ALL
%admin  ALL=(ALL) ALL

since admin1 was also in the "admin" group, the second specification was the one controlling the use of password for user admin1. This functionality is described in the second paragraph of the DESCRIPTION section at the top of the man page.

once I switched the order of entries, user admin1 did not require a password to run sudo commands.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.