2
votes
1answer
121 views

sudo still ask for password when NOPASSWD is used

I read all sudo posts on serverfault, but I still cannot figure out what I'm doing wrong. Normally I finally find the solution but not this time : I want apache user to be able to execute this ...
7
votes
1answer
208 views

Linux/Unix - /etc/sudoers - host definition

can anybody tell me in which case the sudo host definition is useful? I mean this part of a line in the sudoers file: bob host1 = NOPASSWD: reboot In which environment (except sudo via LDAP) do I ...
2
votes
2answers
47 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...
13
votes
3answers
482 views

Which method to use for granting sudo

What is the difference between adding a user to /etc/sudoers and usermod -a -G sudo? Which method should be used for granting sudo?
1
vote
4answers
226 views

Fedora, ssh and sudo

I have to run a script remotely on several Fedora machines through ssh. Since the script requires root priviliges, I do: $ ssh me@remost_host "sudo touch test_sudo" #just a simple example sudo: no ...
1
vote
1answer
70 views

Sudoers NOPASSWD how to grant access to a specific ln command

In /etc/sudoers I need to grant passwordless sudo for this command: /usr/bin/env sudo ln -nfs /home/deployer/apps/myapp_staging/shared/config/nginx.conf /etc/nginx/sites-enabled/ to the deployer ...
1
vote
3answers
128 views

nagios nrpe unable to read output

I'm trying to use check_nrpe to check on a remote server, but it's not working and I can't figure out what am I missing... # /usr/lib/nagios/plugins/check_nrpe -H XXX -c check_load -a 6,5,4 8,7,6 ...
40
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
2
votes
1answer
83 views

mongodb 2.4.9 is crashing on wheezy when running as root

I installed mongodb-10gen v2.4.9 on a debian Wheezy, and I'm having this really weird behavior: if I run it as root I can't get it starts: root@xx:~# /etc/init.d/mongodb stop [ ok ] Stopping ...
2
votes
4answers
92 views

program needs to be run as root by any user and can be located anywhere

I have some program called foo that needs root privileges when it executes. foo needs to be able to be run by any user and can be located at any path. The reason this program can be at any path is ...
2
votes
1answer
250 views

User not in sudoers, but still can use sudo

I have a user user1 that is not in the sudoers file (nor belonging to groups in sudoer) but can still use sudo. How is it possible ? user1~$ groups user1 www-data My sudoer conf ...
4
votes
1answer
1k views

Using FreeIPA for centralized sudo - using SSSD for sudoers

I have setup FreeIPA for centralized sudo and all is working well with the exception of being able to use SSSD for sudoers. If I have in my client /etc/nsswitch.conf the following: sudoers: files ...
3
votes
1answer
201 views

Using FreeIPA for centralized sudo - how to specify ALL commands?

I'm having a hard time wrapping my head around FreeIPA's model. The FreeIPA manual states: FreeIPA adds an extra control measure with sudo command groups, which allow a group of commands to be ...
-1
votes
1answer
106 views

sudo su - <username> should be possible but sudo su - shouldn't be for sudo user

There is a requirement I got. My sudo users (for which their entry in sudoers file) should be able to access other user's account say Oracle using following command: sudo su - Oracle The above ...
0
votes
1answer
63 views

Executing a command as apache

This script keeps outputting a 1. and I cannot understand why. <?php passthru("nohup sudo rndc reload sd.example.com",$op); print_r($op); ?> I have also tried the above code ...
2
votes
4answers
184 views

User with root privileges to restart a service can't

I want a user to be able to restart the php5-fpm service. In visudo, I have the following: username ALL=NOPASSWD: /etc/init.d/php5-fpm When I su to the user and run sudo /etc/init.d/php5-fpm stop, ...
-1
votes
1answer
122 views

sudo to other user doesn't preserve DISPLAY variable

I've got an /etc/sudoers file that works just fine in all versions of Fedora prior to F18, but we've noticed that when upgrading to F18 (and installing FreeIPA, though the cases I'll show here were ...
0
votes
0answers
34 views

visudo passes syntax check but the file fails when put into place

I've been trying to create a modified sudoers file in /etc/sudoers.d/ but am having trouble. visudo -cf /file/path shows no syntax issues, but when i mv /tmp/sudoers/ /etc/sudoers.d/sudoers sudo ...
2
votes
1answer
1k views

sudo still ask for password when NOPASSWD is used

I want to run this script (it is post-receive hook of git repository): #!/bin/sh echo "Executing post-receive hook as user `id` using `which sudo`" sudo -l sudo -n bash ...
1
vote
4answers
340 views

How to fix sudoers file on virtual machine without root and reboot

I've broken my sudoers file on a heavy loaded server with a syntax error. And unfortunately I've lost my root password. The server is critical and I'd like to avoid rebooting. So, no sudo, no root, no ...
2
votes
1answer
181 views

sudo: PAM audit_log_acct_message() failed: Permission denied

.. any time I'm run sudo through NRPE, I'm get a following message in my /var/log/secure, and I can't figure out how to resolve it. sudo: PAM audit_log_acct_message() failed: Permission denied ...
0
votes
4answers
480 views

How to make bash script executable for a user, but not readable

I'm trying to run a script at login that will execute for a regular user, but not be readable by that or other non-root users. I've tried various things including chmod/chown combinations, as well as ...
3
votes
1answer
186 views

Adding group to sudoers has no effect

I'm trying to grant the www-data group access to certain commands under sudo (ie to restart Apache) and I'm having no luck. I spent the majority of Friday looking into this issue and must have looked ...
-2
votes
1answer
54 views

sudo -u … -i doesn't preserve a user's PATH

I'm trying to determine a user's path when I'm root, but sudo, even with the -i flag, doesn't seem to replicate the user's environment correctly. Is this some sudoers policy setting? $ sudo bash # ...
1
vote
1answer
79 views

With sudoers, how can I allow a user to change the group of files/folders within their home directory?

I have a webserver where apache runs as www-data. Users are set up using chef, and some of their file/folder permissions are set to group: www-data, e.g. uploads folders. Deployments are done with ...
0
votes
1answer
381 views

After updating sudoers user still does not have access to sudo

I'm having problems adding a user to the sudoers list via the /etc/sudoers file. $ whoami iain And they said I was crazy! $ which visudo /usr/sbin/visudo $ ls -la /usr/sbin/visudo ---x--x--x 1 ...
4
votes
1answer
766 views

AWS - removing ec2-user from sudo list

I'm running a production-level Amazon ec2 instance, and I want to close out root privileges to all users. Normally, when one logs in to the instance as ec2-user, the ec2-user immediately gets sudo ...
1
vote
2answers
1k views

Best practices to avoid Jenkins error: sudo: no tty present and no askpass program specified

When running any sudo command from Jenkins I get the following error: sudo: no tty present and no askpass program specified I understand that I can solve this by adding a NOPASSWD entry to my ...
0
votes
1answer
176 views

How to avoid specifying full path in sudoers file?

I am trying to add a NOPASSWD entry for sudotest.sh (or any script/binary that requires sudo) in my /etc/sudoers file (on Ubuntu 12.04 LTS server), but in order to make it work, I must specify the ...
0
votes
1answer
74 views

I can't make sudo su on old version CentOS with LDAP

I configured many servers with the option to make "sudo su" with ldap users, and works fine. But in 2 servers (CentOS 5.7 and 5.5) this option show me an error: [user] is not in the sudoers ...
1
vote
1answer
175 views

How to create a sudorule in freeIPA for the sudoedit builtin

Currently, when I want to grant some group of users access to edit a file, I proceed as follows: ipa sudocmd-add --desc=Vi IMproved default-mode, no-exec, no-suspend mode' '/usr/bin/rvim' ipa ...
0
votes
1answer
148 views

Recommendations for bootstrapping Ubuntu server

When I create new Ubuntu 12.10 instances, I typically bootstrap them by manually SSHing onto the machine and editing the sudoers to put a NOPASSWD on the default user (e.g., ec2-user, azureuser, ...
0
votes
0answers
126 views

sudoers works with hostname but not with the full domain name (fqdn)

I'm using puppet to propagate a sudoers file to several environments with different domains like so: Host_Alias STG1 = *.stg1.wa.acme.com Host_Alias STG2 = *.stg2.wa.acme.com This works ...
3
votes
1answer
2k views

How do I set both NOPASSWD and SETENV on the same line in sudoers?

In the sudoers file, how can I use multiple Tag_Specs on the same line. Normally if I don't want to ask for a password I will do something like this: who where = (aswhom) NOPASSWD: commands I ...
2
votes
1answer
131 views

sudo does not preserve TMPDIR

The sudo manpage tells me, that I can preserve the environment by passing the -E option, which does not work in the case of $TMPDIR: > env | grep TMPDIR TMPDIR=/localdata/tmp > sudo env | grep ...
1
vote
2answers
183 views

Why doesn't sudo -i respect the sudoers file

To ensure the proper PATH environment variable is setup, I am using the sudo -i options, but am finding that the sudoers file isn't being respected. Here is my setup: /etc/sudoers: Defaults ...
-2
votes
2answers
56 views

setting up sudo account

I want to create a managed account with root powers and the ability to su as root if need be to manage the box without needing root. What is the correct way to do it? Does this work? ...
2
votes
1answer
450 views

sudoers restriction only works when using “sudo”, how to restrict regular usage?

I have the following in my sudoers.d/nginx file: deployer ALL=NOPASSWD: /etc/init.d/nginx reload This works if I run the command as sudo: $ sudo /etc/init.d/nginx start [sudo] password for ...
0
votes
2answers
138 views

Advice regarding SUID and sudo on Ubuntu Server

Just wanting a bit of advice. I have root access to a server and I want to create a second user and execute everything via sudo should I need to rather than logging in as root. The file /etc/sudoers ...
0
votes
2answers
153 views

sudoers security

I've setup a script to do Subversion updates across two servers - the localhost and a remote server - called by a post-commit hook run by the www-data user. /srv/svn/mysite/hooks/post-commit ...
3
votes
3answers
2k views

How to generate customized sudoers files in puppet depending on the environment they're deployed to?

the sysadmins are present in the sudoers files of all environments, but other sudoers are not. Different environments all have slightly different sudoers. Most of the time, 90% of users are the same, ...
0
votes
1answer
535 views

Parse error in /etc/sudoers on rack mounted box. How can I fix it, since I cannot run sudo?

As full disclosure, no I did not use visudo. Had forgotten such a utility existed. Lesson learned. I was trying to edit my /etc/sudoers to allow password-less command execution for a specific script ...
1
vote
0answers
64 views

Change sudo defaults only for sudo -i

At my site the typical sudoers setup has Defaults mail_always globally set so we can keep track of what the users are generally using sudo for (which should be very infrequent) and sort out fixing the ...
1
vote
1answer
112 views

sudoers entries

Is there a way to have a sudoers entry that allows executing of only a particular command, without any extra arguments? I can't seem to find a resource that describes how command matching works with ...
5
votes
1answer
300 views

Is there a way to allow command in sudo based on the current working directory?

I want sudo to allow me to run a command when my current working directory is, for example, /tmp. Example usage is removing files from /tmp directory, so I am in /tmp ($PWD of shell == /tmp), then I ...
2
votes
1answer
372 views

Why is visudo saying there's a syntax error?

I'm using CentOS uname -a Linux mydomain.com 3.2.29-48.63.amzn1.x86_64 #1 SMP Sat Sep 15 01:43:12 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux I'm trying to add this command to my /etc/sudoers file ...
6
votes
2answers
792 views

Sudoers file allow sudo on specific file for active directory group

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I ...
0
votes
3answers
1k views

Running a command through a tty without commenting out “requiretty”

I'm running the latest version of Jenkins on CentOS. In my Jenkins job, I can run post build steps, and included this command, sudo /bin/rm /usr/java/jboss/server/default/deploy/myclient-1.0.war ...
1
vote
1answer
1k views

ssh remote command using password-less sudo fails

Logged on as bryan@localserver, I'm trying to perform a backup using rsync on a remote host bryan@remoteserver. I need the rsync connection to elevate privileges on the remote host using ...
1
vote
1answer
95 views

Allow a group to run all files under a certain directory in CentOS

I am trying to set up automatic deployment for my Rails app using Capistrano. Capistrano will need to run sudo kill, and I achieved that without it asking me for a password, by editing the ...