3

I have a situation where I want the main admin user (with sudo for all) to have passwordless sudo as another user for one command. To my knowledge, that should give the following in /etc/sudoers:

ramo   ALL=(otherUser) NOPASSWD: /usr/bin/command
ramo   ALL=(ALL) ALL

But it seems like those two lines conflict, or the second overwrites the first. Any ideas on how to accomplish this?

Cheers

Ramo

EDIT: Turns out I slightly misunderstood how sudo works when specifying a user. I was under the impression that if you have ALL=(otherUser) then you didn't need to 'sudo -u otherUser' but could just sudo. This isn't the case.

2 Answers 2

7

The order is important and the behaviour is described in the sudoers(5) man page:

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

With your original rules, the "(ALL) ALL" is the last match and so sudo prompts for the password.

The following /etc/sudoers works:

ramo   ALL=(ALL) ALL
ramo   ALL=(otherUser) NOPASSWD: /bin/whoami

e.g.:

$ sudo -k /bin/whoami
[sudo] password for ramo: 
root
$ sudo -k -u otherUser /bin/whoami
otherUser
$ sudo -k -u otherUser /bin/true
[sudo] password for ramo:
$ sudo -k /bin/true
[sudo] password for ramo:

Tested on Fedora 19 with sudo-1.8.6p7-1

1
  • I'm sure this is technically correct, however it was not the source of my problem: I was assuming sudo selected users to sudo as when specified in /etc/sudoers - see edit.
    – Ramo
    Sep 13, 2013 at 0:13
0

I think you can negate with '!'. Try second line

ramo ALL=(ALL) !/usr/bin/command

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .