Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When running any sudo command from Jenkins I get the following error: 'sudo: no tty present and no askpass program specified'.

I understand that I can solve this by adding a NOPASSWD entry to my /etc/sudoers file which will allow user 'jenkins' to run commands without needing a password. I can add an entry like this:

%jenkins ALL=(ALL)NOPASSWD:/home/vts_share/test/sudotest.sh

...but this leads to the following issue: How to avoid specifying full path in linux sudoers file

I can add an entry like this:

%jenkins ALL=NOPASSWD: ALL

...but this allows user jenkins to avoid the password prompt for ALL commands, which seems a bit unsafe. I'm just curious what my options are here, and if there are any best practices I should consider.

share|improve this question
1  
It seems to me that your problem(s) stem from not really understanding the tools that you are trying to work with. Now would be an opportune time to take a step back and learn some unix fundamentals and read up some on how sudo works. –  Iain Jul 3 '13 at 6:15
add comment

1 Answer

I believe you are looking for this option from man sudoers

   requiretty      If set, sudo will only run when the user is logged in to a real tty.  When this flag     
                   is set, sudo can only be run from a login session and not via other means such as        
                   cron(8) or cgi-bin scripts.  This flag is off by default.     

here are my recommendations in order of most secure to least secure:

1) don't let jenkins sudo at all. if you're doing package builds, look into fakeroot. jenkins doesn't need root to build software.

2) if you do need jenkins to have root, consider either restricting the sudo abilities with the sudoers Cmnd options.

3) run jenkins on a disposable VM. if someone roots it, rebuild it and re-evalutate your security choices. I would also recommend running jenkins as an intranet service, only accessible via LAN or VPN. don't forget to include authentication!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.