The sudoers tag has no wiki summary.
0
votes
1answer
29 views
I can't make sudo su on old version CentOS with LDAP
I configured many servers with the option to make "sudo su" with ldap users, and works fine.
But in 2 servers (CentOS 5.7 and 5.5) this option show me an error:
[user] is not in the sudoers ...
0
votes
1answer
26 views
Allow user to run script as root, but not the individual commands within the script
I don't have much experience with this type of task and realize I need to get more familiar with the sudoers file. I want a user to be able to connect via ssh and run a script that performs a bunch ...
1
vote
1answer
30 views
How to create a sudorule in freeIPA for the sudoedit builtin
Currently, when I want to grant some group of users access to edit a file, I proceed as follows:
ipa sudocmd-add --desc=Vi IMproved default-mode, no-exec, no-suspend mode' '/usr/bin/rvim'
ipa ...
0
votes
0answers
36 views
olcAccess rule for work sudo-ldap
We using zentyal SBS. And we want to use sudo-ldap on the Ubuntu 12.04 Clients to override sudo via ldap ou=SUDOers.
I need a true minimal by security rigths rule in olcAccess for work sudo-ldap.
...
0
votes
1answer
74 views
sudoers nopasswd switch user and run node not working
I'm trying to prevent a password prompt on a command that runs node as the www user by adding the following line to the bottom of my /etc/sudoers file:
gituser ALL=(ALL) NOPASSWD: /usr/bin/sudo -u ...
0
votes
1answer
72 views
Recommendations for bootstrapping Ubuntu server
When I create new Ubuntu 12.10 instances, I typically bootstrap them by manually SSHing onto the machine and editing the sudoers to put a NOPASSWD on the default user (e.g., ec2-user, azureuser, ...
0
votes
0answers
50 views
sudoers works with hostname but not with the full domain name (fqdn)
I'm using puppet to propagate a sudoers file to several environments with different domains like so:
Host_Alias STG1 = *.stg1.wa.acme.com
Host_Alias STG2 = *.stg2.wa.acme.com
This works ...
0
votes
1answer
190 views
How do I set both NOPASSWD and SETENV on the same line in sudoers?
In the sudoers file, how can I use multiple Tag_Specs on the same line.
Normally if I don't want to ask for a password I will do something like this:
who where = (aswhom) NOPASSWD: commands
I ...
2
votes
1answer
50 views
sudo does not preserve TMPDIR
The sudo manpage tells me, that I can preserve the environment by passing the -E option, which does not work in the case of $TMPDIR:
> env | grep TMPDIR
TMPDIR=/localdata/tmp
> sudo env | grep ...
1
vote
2answers
113 views
Why doesn't sudo -i respect the sudoers file
To ensure the proper PATH environment variable is setup, I am using the sudo -i options, but am finding that the sudoers file isn't being respected.
Here is my setup:
/etc/sudoers:
Defaults ...
-2
votes
2answers
54 views
setting up sudo account
I want to create a managed account with root powers and the ability to su as root if need be to manage the box without needing root. What is the correct way to do it?
Does this work?
...
0
votes
2answers
49 views
sudoers file errors on solaris (suspecting wildcards)
I'm trying to write a universal sudoers file to control permissions for all our users across all our environments and I've been using the wildcard for the hostnames like so (all data has been ...
0
votes
1answer
37 views
Can't access directory of another user after giving equivalent access to both
I've edited the /etc/sudoers file through visudo and added
www-data ALL=(git) NOPASSWD: ALL
git ALL=(www-data) NOPASSWD: ALL
so now the user "git" should be able to ...
2
votes
1answer
213 views
sudoers restriction only works when using “sudo”, how to restrict regular usage?
I have the following in my sudoers.d/nginx file:
deployer ALL=NOPASSWD: /etc/init.d/nginx reload
This works if I run the command as sudo:
$ sudo /etc/init.d/nginx start
[sudo] password for ...
0
votes
2answers
79 views
Advice regarding SUID and sudo on Ubuntu Server
Just wanting a bit of advice. I have root access to a server and I want to create a second user and execute everything via sudo should I need to rather than logging in as root. The file /etc/sudoers ...
0
votes
2answers
111 views
sudoers security
I've setup a script to do Subversion updates across two servers - the localhost and a remote server - called by a post-commit hook run by the www-data user.
/srv/svn/mysite/hooks/post-commit ...
3
votes
3answers
365 views
How to generate customized sudoers files in puppet depending on the environment they're deployed to?
the sysadmins are present in the sudoers files of all environments, but other sudoers are not. Different environments all have slightly different sudoers. Most of the time, 90% of users are the same, ...
0
votes
1answer
199 views
Parse error in /etc/sudoers on rack mounted box. How can I fix it, since I cannot run sudo?
As full disclosure, no I did not use visudo. Had forgotten such a utility existed. Lesson learned.
I was trying to edit my /etc/sudoers to allow password-less command execution for a specific script ...
1
vote
2answers
144 views
How to allow unprivileged apache/PHP to do a root task (CentOS)
I am setting up a sort of personal dropbox for our customers on a CentOS 6.3 machine. The server will be accessible thru SFTP and a proprietary http service base on PHP. This machine will be in our ...
1
vote
0answers
43 views
Change sudo defaults only for sudo -i
At my site the typical sudoers setup has Defaults mail_always globally set so we can keep track of what the users are generally using sudo for (which should be very infrequent) and sort out fixing the ...
0
votes
2answers
159 views
allowing sudo to delete certain files
I would like to allow to delete certain files in /tmp directory to sudo users. I have added the Allow_Cmnd /usr/sbin/userdel for sudo users but this does not delete all /tmp files associated with the ...
0
votes
1answer
279 views
Root Locked Out of Ubuntu 12.04?
I may have just locked root out of my server, and am looking for help. I have a VPS web server that has been running 10.04 for the past couple of years. For security, I had disabled root login and ...
1
vote
1answer
76 views
sudoers entries
Is there a way to have a sudoers entry that allows executing of only a particular command, without any extra arguments? I can't seem to find a resource that describes how command matching works with ...
5
votes
1answer
104 views
Is there a way to allow command in sudo based on the current working directory?
I want sudo to allow me to run a command when my current working directory is, for example, /tmp. Example usage is removing files from /tmp directory, so I am in /tmp ($PWD of shell == /tmp), then I ...
1
vote
1answer
146 views
Why is visudo saying there's a syntax error?
I'm using CentOS
uname -a
Linux mydomain.com 3.2.29-48.63.amzn1.x86_64 #1 SMP Sat Sep 15 01:43:12 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
I'm trying to add this command to my /etc/sudoers file ...
3
votes
1answer
382 views
What are the security implications of disabling requiretty in sudoers?
If we add the following lines to sudoers:
Defaults requiretty
Defaults:apache !requiretty
apache ALL=NOPASSWD: /etc/init.d/httpd graceful
What are the security implications?
My understanding is ...
6
votes
2answers
374 views
Sudoers file allow sudo on specific file for active directory group
I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I ...
2
votes
2answers
456 views
Upgrading from OS X 10.7 to 10.8 broke sudo
The following /etc/sudoers entry worked under Mac OS 10.7, but prompts for a password under 10.8:
username ALL=NOPASSWD:/usr/libexec/dovecot/deliver
I assume that Apple upgraded to a newer sudo; ...
1
vote
1answer
155 views
Security implications of adding www-data to /etc/sudoers to run php-cgi as a different user
What I really want to do is allow the 'www-data' user to have the ability to launch php-cgi as another user. I just want to make sure that I fully understand the security implications.
The server ...
0
votes
2answers
583 views
Running a command through a tty without commenting out “requiretty”
I'm running the latest version of Jenkins on CentOS. In my Jenkins job, I can run post build steps, and included this command,
sudo /bin/rm /usr/java/jboss/server/default/deploy/myclient-1.0.war
...
1
vote
1answer
770 views
ssh remote command using password-less sudo fails
Logged on as bryan@localserver, I'm trying to perform a backup using rsync on a remote host bryan@remoteserver.
I need the rsync connection to elevate privileges on the remote host using ...
0
votes
0answers
100 views
visudo limit chmod, chown to specific folders?
I want to give a user access to commands under visudo, but I want to limit their abilities. I know I can limit which commands they can run, but can I limit where they can run them?
For the limitation ...
1
vote
1answer
70 views
Allow a group to run all files under a certain directory in CentOS
I am trying to set up automatic deployment for my Rails app using Capistrano. Capistrano will need to run sudo kill, and I achieved that without it asking me for a password, by editing the ...
0
votes
1answer
232 views
audit_log_user_command(): Connection refused when using sudo, what's wrong?
i ssh to my remote centos sever as hugemeow, then i run sudo ls, then error happens:
[hugemeow@home ~]$ sudo ls
**audit_log_user_command(): Connection refused**
httpd
hugemeow is in /etc/sudoers, ...
2
votes
1answer
368 views
x11vnc through SSH tunnel - sudo: no tty present and no askpass program specified
I'm trying to setup a one-time SSH tunnel which instantiates x11vnc on a logged-in display.
ssh -f -t -L 5900:localhost:5900 user@10.1.10.1 'sudo /usr/bin/x11vnc -safer -once -nopw -display :0 -auth ...
3
votes
1answer
199 views
Run “sudo -u” without asking for the current user's password
I'm sorry if I missed an answer here. But I did Google this and couldn't find a straight forward answer.
I want to enable the apache user to run commands as another user, but when I do:
echo ...
2
votes
1answer
173 views
How to allow a git hook to run an executable with sudo by modifying /etc/sudoers
I'm using a git post-update hook to run a command via sudo, and I get the error: sudo: sorry, you must have a tty to run sudo. I believe I need to modify /etc/sudoers but I don't know how to do this. ...
1
vote
3answers
271 views
Apache sudoers access
I am making a system call from php which is
`sudo /usr/bin/perl -pi -e 's/foo/bar/g' /tmp/newxml.xml`;
which works fine in php cli. But would not work in php via browser, because apache does not ...
3
votes
3answers
423 views
How to sudo as another user, without specifying the username
So I'm currently trying to create a sudoers file, but I ran into something I can't figure out.
The end result I'm looking for is that I want users to be able to do something like:
sudo ...
2
votes
1answer
138 views
Check if a file exists, using another user (sudo -u)
I want to check if a file exists [ -f /path/to/file ] using another user.
So, I added:
USER1 ALL=(USER2) /bin/mkdir, /usr/bin/git, /bin/echo
to the sudoers file.
The problem is, when I ...
3
votes
3answers
107 views
SSH access and control
IS there an ideal way to limit access to server admins as to what they can and can not do with sudo? I would like to have levels of access from basic command line actions to more advanced abilities ...
1
vote
2answers
862 views
Broke my /etc/sudoers file on amazon EC2
I edited my Linux Amazon EC2 instance using vim /etc/sudoers and tried adding another account to the list. I realize now that this was a terrible mistake. I can no longer sudo from any account (which ...
2
votes
1answer
245 views
sudoers not working for tar command
I want to disable the requirement of sudo or running as root for a bash script that does backups with tar.
I added this line to my sudoers file
username ALL=NOPASSWD: /bin/tar
However after I ...
0
votes
4answers
194 views
Operation not permitted
I have a server on Amazon ec2,
When I try to change group file (chgrp danny /tmp/bla) I get "Operation not permitted".
(I don't want to use "sudo")
Anyone know the problem?
1
vote
2answers
231 views
let users group do “sudo -u username chown”
I would like to edit /etc/sudoers so that group users can execute (only) /bin/chown as user dummy. How might this be done?
1
vote
3answers
2k views
How to configure sudoers to always keep LD_LIBRARY_PATH envrionment variable?
No matter what I try, it seems that the LD_LIBRARY_PATH environment variable is not kept after I run a command with sudo. The only way I managed to have it stick, is to prefix my sudo command with ...
4
votes
2answers
138 views
best ways allowing a group to edit some /etc files
we have a group called JBossAdmins and users of this group must edit some /etc files on a RHEL 6:
/etc/httpd/*
/etc/java/*
/etc/jboss/*
my first idea was to give the following sudo permissions:
...
2
votes
3answers
587 views
how to deny “sudo su”
I have several servers where some users require to be sudoers to work. The problem is that when sudoers can run the command sudo su and login as user root. It seems very risky to run that command.
I ...
2
votes
2answers
417 views
How to configure SUDO for no password if user is logged in remotely from a specific host
I would like to configure my Debian box sudoers file as follows:
If USERNAME is remoted in from IP a.a.a.a: No password is needed to use sudo
If USERNAME is remoted in from anywhere else or local: A ...
1
vote
1answer
324 views
EC2 instance: non ec2-user not in sudoer file?
Amazon EC2-instance:
I made a user 'admin' and copied ec2-user's keys with proper permission.
After successful login, i tried to do sudo su for root access, it says 'admin is not in the sudoers file. ...
