Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a situation where I want the main admin user (with sudo for all) to have passwordless sudo as another user for one command. To my knowledge, that should give the following in /etc/sudoers:

ramo   ALL=(otherUser) NOPASSWD: /usr/bin/command
ramo   ALL=(ALL) ALL

But it seems like those two lines conflict, or the second overwrites the first. Any ideas on how to accomplish this?

Cheers

Ramo

EDIT: Turns out I slightly misunderstood how sudo works when specifying a user. I was under the impression that if you have ALL=(otherUser) then you didn't need to 'sudo -u otherUser' but could just sudo. This isn't the case.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The order is important and the behaviour is described in the sudoers(5) man page:

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

With your original rules, the "(ALL) ALL" is the last match and so sudo prompts for the password.

The following /etc/sudoers works:

ramo   ALL=(ALL) ALL
ramo   ALL=(otherUser) NOPASSWD: /bin/whoami

e.g.:

$ sudo -k /bin/whoami
[sudo] password for ramo: 
root
$ sudo -k -u otherUser /bin/whoami
otherUser
$ sudo -k -u otherUser /bin/true
[sudo] password for ramo:
$ sudo -k /bin/true
[sudo] password for ramo:

Tested on Fedora 19 with sudo-1.8.6p7-1

share|improve this answer
    
I'm sure this is technically correct, however it was not the source of my problem: I was assuming sudo selected users to sudo as when specified in /etc/sudoers - see edit. –  Ramo Sep 13 '13 at 0:13

I think you can negate with '!'. Try second line

ramo ALL=(ALL) !/usr/bin/command
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.