Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to run important_script.sh as with sudo -i without password.

If I have in sudoers:

apache ALL = (root) NOPASSWD:    /blah/important_script.sh

and run "sudo /blah/important_script.sh" I can run it without password.

However if I run "sudo -i /blah/important_script.sh" I need to enter password for apache.

If I change line in sudoers to:

apache ALL = (root) NOPASSWD:ALL

I can run command "sudo -i /blah/important_script.sh" without password.

But I want to be able to run only /blah/important_script.sh, not ALL commands.

So, how I setup that only /blah/important_script.sh could be ran with sudo -i without password.

share|improve this question
1  
Did sudo provide you with an error message ? –  Iain Jun 5 '14 at 6:23

1 Answer 1

up vote 5 down vote accepted

When I try this I get an error message which gives a clue to the problem

 Sorry, user bob is not allowed to execute '/bin/bash -c /blah/important_script.sh' as root on host.

Note that we're being denied access to a command /bin/bash -c... which is different from the one we specified in the sudoers file /blah/important_script.... When you tell sudo to allow a user to run a specific command, they have to use the exact command line as specified in sudoers so we need to change sudoers appropriately.

bob   ALL=(root) NOPASSWD: /bin/bash -c /blah/important_script.sh

This now works for bob

$ sudo -i /bin/bash -c /blah/important_script.sh

So why is it doing this ? Well the man page for sudo has the answer

‑i [command] The ‑i (simulate initial login) option runs the shell specified by the password database entry of the target user as a login shell. This means that login-specific resource files such as .profile or .login will be read by the shell. If a command is specified, it is passed to the shell for execution via the shell's ‑c option. If no command is specified, an interactive shell is executed...

share|improve this answer
    
Thank you for the answer. Just for future reference "sudo -i /bin/bash -c /blah/important_script.sh" should be replaced with "sudo -i /blah/important_script.sh" as "/bin/bash -c" will be added by "sudo -i" –  gilbertasm Jun 6 '14 at 1:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.