sudoers is the default configuration file to store sudo security policies governing the rights of users to run commands with elevated or alternate permissions.

learn more… | top users | synonyms

43
votes
8answers
4k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
39
votes
5answers
40k views

How to setup passwordless `sudo` on Linux?

How can passwordless sudo access be setup on either RHEL (Fedora, CentOS, etc) or Ubuntu distributions? (If it's the same across distros, that's even better!) Setting: personal and/or lab/training ...
36
votes
1answer
48k views

sudoers: how to disable requiretty per user

I don't want to uncomment the line in /etc/sudoers: Defaults requiretty Instead, I only want a certain user not to require a tty. How can this be done?
18
votes
14answers
22k views

Why does sudo command take long to execute?

I've been picking up Linux (Fedora 10, then 11) over the past few months (and enjoying it immensely-- it's like discovering computers all over again, so many things to learn). I've added my user to ...
13
votes
3answers
504 views

Which method to use for granting sudo

What is the difference between adding a user to /etc/sudoers and usermod -a -G sudo? Which method should be used for granting sudo?
10
votes
8answers
19k views

using su inside of a shell script

I'm automating a deploy process and I want to be able to just call one .sh file on my machine, have it do my build and upload the .zip to the server and then do a bunch of stuff on the server. One of ...
8
votes
4answers
1k views

Update multiple sudoers file

We have multiple Linux servers that authenticate to an Active Directory Domain. For a group in AD, I want to add a list of commands that are allowed to run as root using sudo. I can obviously ssh-in ...
8
votes
1answer
1k views

AWS - removing ec2-user from sudo list

I'm running a production-level Amazon ec2 instance, and I want to close out root privileges to all users. Normally, when one logs in to the instance as ec2-user, the ec2-user immediately gets sudo ...
8
votes
1answer
920 views

Configuring sudo to work without password

I'm trying to configure sudo to allow all users to restart apache without having to enter a password. Security concerns aside, why isn't this working? I added the line to /etc/sudoers: %admin ...
7
votes
4answers
4k views

Ubuntu : borked my sudoers file, how can I fix it?

I was editing my /etc/sudoers file and saved it but it has a syntax error in there. Now I can't 'sudo vim /etc/sudoers' because sudo thinks the sudoers file is not valid. How can I fix this?
7
votes
2answers
4k views

Is it possible to use sudo with !requiretty for a specific command

I am trying to allow a specific command to be run under sudo without a tty. I found that I can disable requiretty for a group : Defaults:%support !requiretty But I dont know how to do it for a ...
7
votes
1answer
246 views

Linux/Unix - /etc/sudoers - host definition

can anybody tell me in which case the sudo host definition is useful? I mean this part of a line in the sudoers file: bob host1 = NOPASSWD: reboot In which environment (except sudo via LDAP) do I ...
6
votes
2answers
926 views

Sudoers file allow sudo on specific file for active directory group

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I ...
5
votes
5answers
5k views

Centralized sudo sudoers file?

I am the admin of several different servers and currently there is a different sudoers file on each one. This is getting slightly out of hand as quite often I need to give someone permissions to do ...
5
votes
5answers
12k views

Where is the sudoers file on Solaris?

Where is the sudoers file in Solaris? Is it different between Solaris versions (specifically, 9 and 10)?
5
votes
3answers
4k views

HOW TO: disable sudoer from editing /etc/sudoers file?

How can I prevent a sudoer from editing the /etc/sudoer file?
5
votes
2answers
2k views

sudo chown - prevent ../

Need to allow a user to chown files under a particular directory using sudo. This does the trick: user1 ALL= NOPASSWD: /bin/chown -[RPfchv] user2\:user2 /opt/some/path/[a-zA-Z0-9]* But, does not ...
5
votes
1answer
382 views

Is there a way to allow command in sudo based on the current working directory?

I want sudo to allow me to run a command when my current working directory is, for example, /tmp. Example usage is removing files from /tmp directory, so I am in /tmp ($PWD of shell == /tmp), then I ...
4
votes
4answers
2k views

Broke my /etc/sudoers file on amazon EC2

I edited my Linux Amazon EC2 instance using vim /etc/sudoers and tried adding another account to the list. I realize now that this was a terrible mistake. I can no longer sudo from any account (which ...
4
votes
2answers
173 views

best ways allowing a group to edit some /etc files

we have a group called JBossAdmins and users of this group must edit some /etc files on a RHEL 6: /etc/httpd/* /etc/java/* /etc/jboss/* my first idea was to give the following sudo permissions: ...
4
votes
6answers
2k views

Scripts That Need (some) Root Access

I have a general question about system administration scripts that require "some" commands to be executed with root access, and other as a normal non-root user (ie myusername, etc.). I should mention ...
4
votes
2answers
2k views

Execute build task in Hudson with root privilages

I have a build script which executes apt-get and therefore requires root privileges. What is the best way to run this script in Hudson? Currently the only solution I have found that works is to add ...
4
votes
3answers
414 views

sudoer scheme to allow useful access to another web developer yet retain future control of a virtual server?

Background: Virtual Private Server I have a virtual private server that I'm looking to host multiple websites on, and provide access to another web developer. I don't care about putting too many ...
4
votes
1answer
3k views

Using FreeIPA for centralized sudo - using SSSD for sudoers

I have setup FreeIPA for centralized sudo and all is working well with the exception of being able to use SSSD for sudoers. If I have in my client /etc/nsswitch.conf the following: sudoers: files ...
3
votes
3answers
2k views

How does sudo relate to Solaris? (most interested in Solaris 11)

We will be creating a new server build model using Solaris 11 and I wanted to know a little more about sudo. I have had very limited introduction to how it works in Ubuntu Linux, but we only use that ...
3
votes
3answers
729 views

How to sudo as another user, without specifying the username

So I'm currently trying to create a sudoers file, but I ran into something I can't figure out. The end result I'm looking for is that I want users to be able to do something like: sudo ...
3
votes
3answers
2k views

How to generate customized sudoers files in puppet depending on the environment they're deployed to?

the sysadmins are present in the sudoers files of all environments, but other sudoers are not. Different environments all have slightly different sudoers. Most of the time, 90% of users are the same, ...
3
votes
1answer
2k views

How do I set both NOPASSWD and SETENV on the same line in sudoers?

In the sudoers file, how can I use multiple Tag_Specs on the same line. Normally if I don't want to ask for a password I will do something like this: who where = (aswhom) NOPASSWD: commands I ...
3
votes
2answers
5k views

Allow User 'git' to run 'git pull' as 'www-data' via sudo

I would like to allow git to run 'git pull' as user 'www-data'. As far as i understand git ALL=(www-data) git pull in /etc/sudoers should make it. Sadly i get an Syntax error for this line and ...
3
votes
4answers
8k views

Allow Apache to run a command as a different user

I have a script that executes several commands in a user's home directory. The files are owned by the user and Apache (the www-data group) only has read privileges to them. The script needs to be ...
3
votes
1answer
329 views

sudo still ask for password when NOPASSWD is used

I read all sudo posts on serverfault, but I still cannot figure out what I'm doing wrong. Normally I finally find the solution but not this time : I want apache user to be able to execute this ...
3
votes
3answers
116 views

SSH access and control

IS there an ideal way to limit access to server admins as to what they can and can not do with sudo? I would like to have levels of access from basic command line actions to more advanced abilities ...
3
votes
1answer
13k views

sudo: no tty present and no askpass program specified (trying to start apachectl)

we are running hudson to monitor a couple of shell jobs. The problem is that hudson runs all jobs as user "hudson". That's ok, except for some special commands that require super user rights, like ...
3
votes
1answer
1k views

What are the security implications of disabling requiretty in sudoers?

If we add the following lines to sudoers: Defaults requiretty Defaults:apache !requiretty apache ALL=NOPASSWD: /etc/init.d/httpd graceful What are the security implications? My understanding is ...
3
votes
1answer
484 views

Run “sudo -u” without asking for the current user's password

I'm sorry if I missed an answer here. But I did Google this and couldn't find a straight forward answer. I want to enable the apache user to run commands as another user, but when I do: echo ...
3
votes
1answer
464 views

Using FreeIPA for centralized sudo - how to specify ALL commands?

I'm having a hard time wrapping my head around FreeIPA's model. The FreeIPA manual states: FreeIPA adds an extra control measure with sudo command groups, which allow a group of commands to be ...
3
votes
1answer
360 views

Adding group to sudoers has no effect

I'm trying to grant the www-data group access to certain commands under sudo (ie to restart Apache) and I'm having no luck. I spent the majority of Friday looking into this issue and must have looked ...
3
votes
1answer
286 views

Sudo resetting environment variables

Whenever I use the sudo command, none of my environment variables appear to be preserved. I've tried modifying the sudoers file, by removing the env_reset specification. #Defaults env_reset I've ...
2
votes
4answers
711 views

Is sudo command restriction in /etc/sudoers secure?

I try to restrict a backup daemon's user (that needs root access to client machines) so that it can only use the one command it needs. Thus, in /etc/sudoers, I use daemonuser ALL=NOPASSWD: ...
2
votes
3answers
1k views

how to deny “sudo su”

I have several servers where some users require to be sudoers to work. The problem is that when sudoers can run the command sudo su and login as user root. It seems very risky to run that command. I ...
2
votes
2answers
165 views

remove specifying the full path in sudoers

I am trying to add a NOPASSWD entry for 'sudotest.sh' (or any script/binary that requires sudo) in my /etc/sudoers file (redhat) but in order to make it work, I must specify the full path. The ...
2
votes
3answers
5k views

How to configure sudoers to always keep LD_LIBRARY_PATH envrionment variable?

No matter what I try, it seems that the LD_LIBRARY_PATH environment variable is not kept after I run a command with sudo. The only way I managed to have it stick, is to prefix my sudo command with ...
2
votes
5answers
2k views

Debian and LDAP for sudo

I'm on debian and want sudo to use ldap instead of /etc/sudoers. Anyone have exprience doing this?
2
votes
1answer
284 views

User not in sudoers, but still can use sudo

I have a user user1 that is not in the sudoers file (nor belonging to groups in sudoer) but can still use sudo. How is it possible ? user1~$ groups user1 www-data My sudoer conf ...
2
votes
2answers
274 views

sudo asks me for password [closed]

i edited /etc/sudoers using visudo command so as to grant user sudo privilege without password as following : userName ALL=(ALL:ALL) NOPASSWD:ALL but it didn't work for me , any suggestions ...
2
votes
2answers
858 views

run a script on remote server

I am trying to run a script on remote server as a root user. I have this line in my shell script. cat /home/myuser/create_user_updated.sh | ssh myuser@$myip "sudo sh" I get the following error. ...
2
votes
4answers
134 views

program needs to be run as root by any user and can be located anywhere

I have some program called foo that needs root privileges when it executes. foo needs to be able to be run by any user and can be located at any path. The reason this program can be at any path is ...
2
votes
1answer
3k views

sudo still ask for password when NOPASSWD is used

I want to run this script (it is post-receive hook of git repository): #!/bin/sh echo "Executing post-receive hook as user `id` using `which sudo`" sudo -l sudo -n bash ...
2
votes
1answer
536 views

sudoers restriction only works when using “sudo”, how to restrict regular usage?

I have the following in my sudoers.d/nginx file: deployer ALL=NOPASSWD: /etc/init.d/nginx reload This works if I run the command as sudo: $ sudo /etc/init.d/nginx start [sudo] password for ...
2
votes
1answer
3k views

Setup RHEL/CentOS 5 to use SUDO in command line and X

How do I make CentOS/RHEL prompt me for my password (and not roots) when I run a privileged command. I have found many guides that detail how to do this for the command line but I want it to work ...