I'm trying to grant the www-data group access to certain commands under sudo (ie to restart Apache) and I'm having no luck. I spent the majority of Friday looking into this issue and must have looked at 20 forum posts, and SO/SF threads pertaining to the issue with no luck.
Following is my sudoers file (edited via visudo).
# # This file MUST be edited with the 'visudo' command as root # # Please consider adding local content in /etc/sudoers.d/ instead of # directly modifying this file. # # See the man page for details on how to write a sudoers file. Defaults !requiretty Defaults env_reset Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:$ # Host alias specification # User alias specification # Cmnd alias specification # User privilege specification root ALL=(ALL:ALL) ALL # Members of the admin group may gain root privileges %admin ALL=(ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL # Allow members of www-data group access to apache %www-data ALL= NOPASSWD: /usr/bin/service apache2 * # See sudoers(5) for more information on "#include" directive
If I log in as my jenkins user (which is part of the www-data group as shown below);
root@ip-REDACTED:~# groups jenkins jenkins : www-data jenkins
I am unable to run "sudo service apache2 restart" as seen below.
jenkins@REDACTED:/root$ sudo service apache restart [sudo] password for jenkins: jenkins is not allowed to run sudo on ip-REDACTED. This incident will be reported.
Jenkins is not part of the sudo group, but I don't want it to be as then it will have access to everything. Also, it doesn't seem to be picking up on the NOPASSWD flag that has been set in sudoers. I've tried everything I can think of at this point and am coming up blank. It might be worth mentioning that this is running on an EC2 instance, does EC2 place any additional restrictions on what can be done with the sudoers file?
Thanks in advance.