sudoers is the default configuration file to store sudo security policies governing the rights of users to run commands with elevated or alternate permissions.

learn more… | top users | synonyms

1
vote
3answers
581 views

Security implications of adding www-data to /etc/sudoers to run php-cgi as a different user

What I really want to do is allow the 'www-data' user to have the ability to launch php-cgi as another user. I just want to make sure that I fully understand the security implications. The server ...
0
votes
2answers
38 views

Execute bash script as root from normal user

I am trying to execute a bash script as root from a normal user. The story behind is that I need the www-data user to be able to kill a specific process. To avoid having apache being able to go mayhem ...
0
votes
2answers
168 views

sudoers security

I've setup a script to do Subversion updates across two servers - the localhost and a remote server - called by a post-commit hook run by the www-data user. /srv/svn/mysite/hooks/post-commit ...
5
votes
1answer
394 views

Is there a way to allow command in sudo based on the current working directory?

I want sudo to allow me to run a command when my current working directory is, for example, /tmp. Example usage is removing files from /tmp directory, so I am in /tmp ($PWD of shell == /tmp), then I ...
3
votes
1answer
295 views

Sudo resetting environment variables

Whenever I use the sudo command, none of my environment variables appear to be preserved. I've tried modifying the sudoers file, by removing the env_reset specification. #Defaults env_reset I've ...
2
votes
1answer
178 views

mongodb 2.4.9 is crashing on wheezy when running as root

I installed mongodb-10gen v2.4.9 on a debian Wheezy, and I'm having this really weird behavior: if I run it as root I can't get it starts: root@xx:~# /etc/init.d/mongodb stop [ ok ] Stopping ...
1
vote
1answer
913 views

winbind separator and group name behavior in getent group, constantly changing

I have a problem that occasionally apprears-dissapears and it drives me nuts. My Debian servers are authenticated against AD and only "linuxadmins" group member can SSH to server and "sudo su". SSH ...
0
votes
1answer
27 views

sudo : wildcard in user/group name

I try to find a solution about a sudo problem. I need to push different sudoers files on different servers, depending on the users present on the servers. But I would like to know if I can avoid that ...
0
votes
1answer
41 views

Monitor root commands issued by users

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file Defaults env_reset ...
0
votes
1answer
102 views

Executing a command as apache

This script keeps outputting a 1. and I cannot understand why. <?php passthru("nohup sudo rndc reload sd.example.com",$op); print_r($op); ?> I have also tried the above code ...
0
votes
1answer
118 views

Configure LDAP for SUDO Support on Ubuntu Server 12.04

I'm running into some issues finishing my LDAP install. I used the following article to try the sudoers schema configured: http://ubuntuforums.org/showthread.php?t=1421998 When I run ldapadd -x -D ...
0
votes
1answer
356 views

sudoers file cleanup and consolidation tool/script

I am curious to know what other folks out there might be using to keep the sudoers file in a sane manner. I am looking for a tool, that removes redundant entries, overlapping permissions and/or ...
-1
votes
1answer
542 views

sudo su - <username> should be possible but sudo su - shouldn't be for sudo user

There is a requirement I got. My sudo users (for which their entry in sudoers file) should be able to access other user's account say Oracle using following command: sudo su - Oracle The above ...
2
votes
0answers
22 views

For sudo su - to retain SUDO_* environment variables?

We have a number of script (for Openstack operations) which require privileged execution in our environment. For some of the scripts we'd like to refer back to the USERNAME or UID of the person who ...
1
vote
0answers
45 views

What is a safe alternative to wildcards in /etc/sudoers?

In the /etc/sudoers file on my Red Hat server, I have this line: %webdevgroup ALL=NOPASSWD: /bin/chmod * /home/http/* This is clearly a bad idea, since someone could do something like this: sudo ...
1
vote
0answers
71 views

Does my deploy user need to belong to the sudoer list for Upstart to start GUnicorn?

Does my deploy user need to belong to the sudoer list for Upstart to start GUnicorn? Here is the error from my Upstart log deploy is not in the sudoers file. This incident will be reported. It ...
1
vote
0answers
67 views

Change sudo defaults only for sudo -i

At my site the typical sudoers setup has Defaults mail_always globally set so we can keep track of what the users are generally using sudo for (which should be very infrequent) and sort out fixing the ...
0
votes
0answers
40 views

visudo passes syntax check but the file fails when put into place

I've been trying to create a modified sudoers file in /etc/sudoers.d/ but am having trouble. visudo -cf /file/path shows no syntax issues, but when i mv /tmp/sudoers/ /etc/sudoers.d/sudoers sudo ...
0
votes
0answers
149 views

sudoers works with hostname but not with the full domain name (fqdn)

I'm using puppet to propagate a sudoers file to several environments with different domains like so: Host_Alias STG1 = *.stg1.wa.acme.com Host_Alias STG2 = *.stg2.wa.acme.com This works ...