Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At my site the typical sudoers setup has Defaults mail_always globally set so we can keep track of what the users are generally using sudo for (which should be very infrequent) and sort out fixing the permissions for common actions. This is disabled per role account that needs to execute things as root.

We've shifted to a policy of discourage direct logins as role accounts for the purposes of auditing and preventing the role users from becoming "party accounts". Thus, we have a lot of logins as a regular user than then immediately invoke sudo -u <role account> -i. I would really like to set !mail_always just for the -i action (which AFAIK, there is no way to specific set rules for -i in sudo) or user X running a command as just user foo. Is this possible? I feel the syntax should be something like this:

Defaults[:!>]realuser ALL = (roleuser) NOPASSWD: ALL !mail_always

UPDATE:

I've found a livable, if not ideal solution:

Defaults>ROLE_ACCOUNTS !mail_always
%wheel ALL = (ROLE_ACCOUNTS) NOPASSWD: ALL

This isn't ideal as any user, not just the members of the wheel group, will not generate email notifications when running commands or invoking login shells as one of the role accounts.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.