Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the following in my sudoers.d/nginx file:

deployer ALL=NOPASSWD: /etc/init.d/nginx reload

This works if I run the command as sudo:

$ sudo /etc/init.d/nginx start
[sudo] password for deployer: 
Sorry, user deployer is not allowed to execute '/etc/init.d/nginx start' as root on graduation.

However, when I run the command as non-sudo, it seems as if sudoers gets passed. The command still doesn't work, but that is because of other ownership errors, not the restriction in sudoers:

$ /etc/init.d/nginx start
nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
2012/12/30 20:59:49 [warn] 30054#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:12
2012/12/30 20:59:49 [emerg] 30054#0: open() "/var/log/nginx/access.log" failed (13: Permission denied)

Is this expected behaviour? And if so, why is this happening? I would expect the sudoers verification to happen before running a command. Do sudoers rules only apply to commands run as sudo? (makes sense, given its name).

And if this is the case, are there any other ways to restrict regular access to commands without using sudo?

Basically I would like my deployer user to do only two things:

  • own its home directory /var/www
  • be able to execute /etc/init.d/nginx reload

All other things should be off-limits (ideally even cd'ing outside the home directory)

share|improve this question
1  
Have you noticed that the sudoers file allows reload only while you tried start? –  ott-- Dec 30 '12 at 20:31
    
@ott-- not sure what you mean, but the above does work correctly when using sudo. I am allowed to execute reload and get the correct error when using start: Sorry, user deployer is not allowed to execute '/etc/init.d/nginx start' as root on hostname. –  JeanMertz Dec 30 '12 at 22:20

1 Answer 1

up vote 8 down vote accepted

This is expected behaviour, the sudoers file is only consulted when you run sudo so it denies the user access to the command and gives you the relevant error message.

When the user tries to run the command directly, sudo is not involved so you get the error messages produced by the individual commands failing because the user lacks privilege.

If you want to restrict the user to just one activity then you could allow them to log in via ssh and tie their keys to to the single command by using

command="/usr/bin/sudo /etc/init.d/nginx reload" ssh-rsa AAAAB3NzaC1...

With this configuration when the user logs in then the reload is performed and they are logged out.

If, at a later date, you decide that you need the user to carry out other operations then you can extend this idea.

share|improve this answer
    
Thank you for this explanation. I expected as much. This makes perfect sense. Restricting SSH possibilities seems like a nice solution, if maybe a bit too restrictive. –  JeanMertz Dec 30 '12 at 22:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.