sudoers is the default configuration file to store sudo security policies governing the rights of users to run commands with elevated or alternate permissions.

learn more… | top users | synonyms

2
votes
0answers
16 views

For sudo su - to retain SUDO_* environment variables?

We have a number of script (for Openstack operations) which require privileged execution in our environment. For some of the scripts we'd like to refer back to the USERNAME or UID of the person who ...
0
votes
2answers
37 views

Linux: How to allow a regular user to “su - anotherUser”?

I wrote a Nagios check script which checks if user peeradmin is able to touch a file in some mount on the server. Nagios user is: nagios . I've edited /etc/sudoers and added these lines but none ...
1
vote
1answer
902 views

winbind separator and group name behavior in getent group, constantly changing

I have a problem that occasionally apprears-dissapears and it drives me nuts. My Debian servers are authenticated against AD and only "linuxadmins" group member can SSH to server and "sudo su". SSH ...
1
vote
3answers
1k views

Using a non-root to deploy a git repo to the web root

What is the best way to set up users and permissions for a production web server that uses git to deploy to the server? Background Running Ubuntu 12.04, I have apache serving files under /var/www as ...
-1
votes
1answer
43 views

How to deny a specific user to reboot or shut down with sudo [duplicate]

Hello and thanks for helping me in this question. I just have in /ets/sudoers something like this: # User Aliases User_Alias CLIENT = jhonny CLIENT myserver = ALL. !ADMIN_CMD,!SU I just want deny ...
18
votes
14answers
22k views

Why does sudo command take long to execute?

I've been picking up Linux (Fedora 10, then 11) over the past few months (and enjoying it immensely-- it's like discovering computers all over again, so many things to learn). I've added my user to ...
2
votes
3answers
5k views

nagios nrpe unable to read output

I'm trying to use check_nrpe to check on a remote server, but it's not working and I can't figure out what am I missing... # /usr/lib/nagios/plugins/check_nrpe -H XXX -c check_load -a 6,5,4 8,7,6 ...
0
votes
1answer
41 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
42
votes
8answers
4k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
0
votes
1answer
98 views

ubuntu sudoers file hacked?

I've 3 ubuntu 14.04 vm on a remote hosting for code repository and testing purpose. I've got them for more than 1 year now. Two of them are working properly, but on one of them I can't run root ...
0
votes
3answers
62 views

How to grant user modify only specific protected file by sudo

I need to grant user modify some files by sudo that have only read-only access. For example, I want to grant user 'hosteditor' modify '/etc/hosts' file. I added to sudoers follow line: hosteditor ...
0
votes
0answers
38 views

What is a safe alternative to wildcards in /etc/sudoers?

In the /etc/sudoers file on my Red Hat server, I have this line: %webdevgroup ALL=NOPASSWD: /bin/chmod * /home/http/* This is clearly a bad idea, since someone could do something like this: sudo ...
0
votes
2answers
32 views

Execute bash script as root from normal user

I am trying to execute a bash script as root from a normal user. The story behind is that I need the www-data user to be able to kill a specific process. To avoid having apache being able to go mayhem ...
-1
votes
1answer
73 views

How to pass the SSH_AUTH_SOCK through sudo (Permission denied (publickey).) [duplicate]

I have a Ubuntu server with the users: ubuntu and user I connect to each of the users using ssh -A (to pass my local machine keys to SSH). From any of the users I can connect to the SSH server of ...
-1
votes
1answer
155 views

How to make sudo -u not require password [closed]

I'm using ansible with vagrant and ansible is trying to sudo as postgres user to run some postgres commands. Ansible running as vagrant user seems to run something like sudo -u postgres psql This ...
0
votes
1answer
257 views

Setting up Sudo in CentOS-7

In CentOS 6.5, i would do the following to setup sudo for users - useradd -G wheel -c "John Smith" jsmith visudo uncomment this line - %wheel ALL=(ALL) ALL usermod -G wheel -a jsmith restart ...
0
votes
1answer
76 views

Visudo Gives no Error but asks “What Now?”

I'm trying to add a new sudoers file using sudo visudo -f /etc/sudoers.d/abe . I added the contents: # Allow automatic update of abe matt ALL=(root) NOPASSWD: python /home/matt/token-abe/setup.py ...
0
votes
2answers
193 views

Sudo without password issue

Having a problem with sudo. As the user forge I want to be able to run sudo service php5-fpm reload without having to type a password. I've tried all of the variants below. forge ALL=NOPASSWD: ...
-2
votes
1answer
68 views

create file with sudo but have ownership as current user [closed]

I am on centos 6.5. I have a limited user. I gave the user some specific rights via sudoers. Lets say its user1. I want user1 to create a file in a directory where he has ownership. Therefore I run ...
-2
votes
3answers
132 views

Enable Passwordless Sudo with Arguments

I am trying to enable passwordless sudo for updating yum on a RHEL box. I have the following line in sudo visudo. myuser ALL=(ALL) NOPASSWD: /usr/bin/yum update After doing this under myuser I am ...
4
votes
4answers
2k views

Broke my /etc/sudoers file on amazon EC2

I edited my Linux Amazon EC2 instance using vim /etc/sudoers and tried adding another account to the list. I realize now that this was a terrible mistake. I can no longer sudo from any account (which ...
3
votes
1answer
409 views

sudo still ask for password when NOPASSWD is used

I read all sudo posts on serverfault, but I still cannot figure out what I'm doing wrong. Normally I finally find the solution but not this time : I want apache user to be able to execute this ...
13
votes
3answers
506 views

Which method to use for granting sudo

What is the difference between adding a user to /etc/sudoers and usermod -a -G sudo? Which method should be used for granting sudo?
7
votes
1answer
251 views

Linux/Unix - /etc/sudoers - host definition

can anybody tell me in which case the sudo host definition is useful? I mean this part of a line in the sudoers file: bob host1 = NOPASSWD: reboot In which environment (except sudo via LDAP) do I ...
1
vote
3answers
566 views

Security implications of adding www-data to /etc/sudoers to run php-cgi as a different user

What I really want to do is allow the 'www-data' user to have the ability to launch php-cgi as another user. I just want to make sure that I fully understand the security implications. The server ...
37
votes
1answer
49k views

sudoers: how to disable requiretty per user

I don't want to uncomment the line in /etc/sudoers: Defaults requiretty Instead, I only want a certain user not to require a tty. How can this be done?
1
vote
4answers
251 views

How do I use saz-sudo puppet module to deploy my own sudoers file with hiera?

I have saz-sudo installed and have created a site_sudo module based (I hope) on it. Here's what I have in my site_sudo/manifest/init.pp file: class { 'site_sudo': } sudo::conf { 'web': ...
2
votes
2answers
103 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...
1
vote
4answers
550 views

Fedora, ssh and sudo

I have to run a script remotely on several Fedora machines through ssh. Since the script requires root priviliges, I do: $ ssh me@remost_host "sudo touch test_sudo" #just a simple example sudo: no ...
1
vote
2answers
3k views

Best practices to avoid Jenkins error: sudo: no tty present and no askpass program specified

When running any sudo command from Jenkins I get the following error: sudo: no tty present and no askpass program specified I understand that I can solve this by adding a NOPASSWD entry to my ...
0
votes
1answer
283 views

How to avoid specifying full path in sudoers file?

I am trying to add a NOPASSWD entry for sudotest.sh (or any script/binary that requires sudo) in my /etc/sudoers file (on Ubuntu 12.04 LTS server), but in order to make it work, I must specify the ...
39
votes
5answers
41k views

How to setup passwordless `sudo` on Linux?

How can passwordless sudo access be setup on either RHEL (Fedora, CentOS, etc) or Ubuntu distributions? (If it's the same across distros, that's even better!) Setting: personal and/or lab/training ...
1
vote
1answer
196 views

Sudoers NOPASSWD how to grant access to a specific ln command

In /etc/sudoers I need to grant passwordless sudo for this command: /usr/bin/env sudo ln -nfs /home/deployer/apps/myapp_staging/shared/config/nginx.conf /etc/nginx/sites-enabled/ to the deployer ...
0
votes
1answer
80 views

Sudo Command Alias option equivalent in OpenLDAP

I have an OpenLDAP installation that manages Sudo as well. Everytime I create a sudoers role, I have to list the commands that that sudoers role can run. This leads to a lot of repetition. Is there ...
-1
votes
1answer
370 views

How to set “sudoers” in nsswitch.conf on Solaris-11

I am doing this on Solaris 11. When i open '/etc/nsswitch.conf' i see this - ... sudoers: files ... I would like to change this to - ... sudoers: files ldap ... I tried editing the file ...
3
votes
4answers
8k views

Allow Apache to run a command as a different user

I have a script that executes several commands in a user's home directory. The files are owned by the user and Apache (the www-data group) only has read privileges to them. The script needs to be ...
0
votes
3answers
2k views

Running a command through a tty without commenting out “requiretty”

I'm running the latest version of Jenkins on CentOS. In my Jenkins job, I can run post build steps, and included this command, sudo /bin/rm /usr/java/jboss/server/default/deploy/myclient-1.0.war ...
2
votes
1answer
174 views

mongodb 2.4.9 is crashing on wheezy when running as root

I installed mongodb-10gen v2.4.9 on a debian Wheezy, and I'm having this really weird behavior: if I run it as root I can't get it starts: root@xx:~# /etc/init.d/mongodb stop [ ok ] Stopping ...
2
votes
4answers
136 views

program needs to be run as root by any user and can be located anywhere

I have some program called foo that needs root privileges when it executes. foo needs to be able to be run by any user and can be located at any path. The reason this program can be at any path is ...
2
votes
2answers
177 views

remove specifying the full path in sudoers

I am trying to add a NOPASSWD entry for 'sudotest.sh' (or any script/binary that requires sudo) in my /etc/sudoers file (redhat) but in order to make it work, I must specify the full path. The ...
2
votes
1answer
288 views

User not in sudoers, but still can use sudo

I have a user user1 that is not in the sudoers file (nor belonging to groups in sudoer) but can still use sudo. How is it possible ? user1~$ groups user1 www-data My sudoer conf ...
2
votes
1answer
123 views

Strange PATH when use sudoers via ldap

I have a working LDAP authentication environment. LDAP server is on ubuntu 12.04 machine while client are all centos 6.4 machines. Recently I configure sudoers in LDAP following this article ...
4
votes
1answer
3k views

Using FreeIPA for centralized sudo - using SSSD for sudoers

I have setup FreeIPA for centralized sudo and all is working well with the exception of being able to use SSSD for sudoers. If I have in my client /etc/nsswitch.conf the following: sudoers: files ...
2
votes
1answer
80 views

sudoers entry allowing group to run as group with no password

I want to add an entry to sudoers that will allows users in the group test to run any command on any host as the group test (i.e., with sudo -g test, without having to type a password. I've tried a ...
10
votes
8answers
20k views

using su inside of a shell script

I'm automating a deploy process and I want to be able to just call one .sh file on my machine, have it do my build and upload the .zip to the server and then do a bunch of stuff on the server. One of ...
3
votes
1answer
510 views

Using FreeIPA for centralized sudo - how to specify ALL commands?

I'm having a hard time wrapping my head around FreeIPA's model. The FreeIPA manual states: FreeIPA adds an extra control measure with sudo command groups, which allow a group of commands to be ...
-2
votes
1answer
65 views

How to edit sudoers file in ubuntu [closed]

I accidentally changed the mode of the file /etc/sudoers and added a line to the file. Now every time I want to "sudo", I got a error message like "parse error in /etc/sudoers near line 21" I ...
2
votes
4answers
217 views

User with root privileges to restart a service can't

I want a user to be able to restart the php5-fpm service. In visudo, I have the following: username ALL=NOPASSWD: /etc/init.d/php5-fpm When I su to the user and run sudo /etc/init.d/php5-fpm stop, ...
-1
votes
1answer
516 views

sudo su - <username> should be possible but sudo su - shouldn't be for sudo user

There is a requirement I got. My sudo users (for which their entry in sudoers file) should be able to access other user's account say Oracle using following command: sudo su - Oracle The above ...
0
votes
1answer
102 views

Executing a command as apache

This script keeps outputting a 1. and I cannot understand why. <?php passthru("nohup sudo rndc reload sd.example.com",$op); print_r($op); ?> I have also tried the above code ...