3

I have sudo set up for a user (myuser) as follows on "hostname" (sudoers content):

Cmnd_Alias SCRIPT=/path/script*
myuser ALL=(suser) NOPASSWD: SCRIPT

this works fine, so I can run the following, logged in locally as myuser on hostname, without need for password:

sudo -u suser /path/script

however, when I use ssh (with keys set up, so no password required) to login and run, as follows:

ssh hostname sudo -u suser /path/script 

I get prompted for a password, and when the password is entered I get:

Sorry, user myuser is not allowed to execute '/path/script' as suser on hostname
.

UPDATE The problem is solved by removing the "*" from the end of the command in sudoers. The * was added to allow parameters to be passed to script, but actually doesn't appear to be necessary. Still don't understand why the * allows the sudo to work locally, but not over ssh. So question still stands

19
  • Are you logging into an SSH server that requires password authentication? Jun 27, 2012 at 16:06
  • no, I have keys set up Jun 27, 2012 at 16:11
  • In your sudoers file, did you use the ALL keyword? You may want to try an ALL=ALL config just to identify the root cause. user ALL=(ALL) ALL NO PASSWD: ALL If that config works, and it should, then the remaining task is just paring back the permissions to the appropriate level. Jun 27, 2012 at 16:22
  • when you get asked for a password, if you supply it does the command work ok ?
    – user9517
    Jun 27, 2012 at 17:15
  • @Iain - no, it says my user is not allowed to execute the script as user on hostname Jun 27, 2012 at 17:27

2 Answers 2

3

You didn't specify a host in the sudoers, so it only works locally as you have it setup now.

So if you set the host parameter to ALL, it will work on any host.

From man sudoers:

The reserved word ALL is a built-in alias that always causes a match to succeed. It can be used wherever one might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias, or Host_Alias.

...

By default, if the NOPASSWD tag is applied to any of the entries for a user on the current host, he or she will be able to run sudo -l without a password. Additionally, a user may only run sudo -v without a password if the NOPASSWD tag is present for all a user's entries that pertain to the current host. This behavior may be overridden via the verifypw and listpw options.

The additional fact that the following works at the terminal seems to bear out that the host is the reason you get prompted.

$ ssh hostname

$ sudo -u user /path/script

9
  • OK, I'll have a word with sysadmin, and try to change. Thanks Jun 27, 2012 at 16:56
  • The output of sudo -l which the OP posts doesn't show the hostname portion of the spec from the sudoers file.
    – user9517
    Jun 27, 2012 at 17:02
  • I only need to run this on one host - so can that host get specified in the sudoers file? (rather than ALL) Jun 27, 2012 at 17:05
  • @Lain, it is true that that the sudo-l shows info for the current host only, still seems to be behaving that way though. Jun 27, 2012 at 17:07
  • 2
    If you try to specify an sudoers entry without a hostname or Host_Alias then visudo will not save the file. Like me you have been misdirected by the OP not saying that the apparent sudoers line above was generated by sudo -l.
    – user9517
    Jun 27, 2012 at 17:11
2

The syntax you are showing for the sudoers file is incorrect and visudo won't let you create a file with that syntax. It should be something like

testuser hostname=(user) NOPASSWD: /path/script*

Using this syntax I can ssh to hostname and execute a script without eing asked for a password.

EDIT

From reading the comments it seems that there is an misconfiguration in your sudoers file. This would appear to be something to to with the Host_Alias or hostname specification part of the line.

I've set up a testuser on a CentOS 6 system and tried various configurations and can't find one that works when I'm logged in locally but denies me access when trying via ssh.

3
  • I don't have access to the sudoers file. I'm showing the output of sudo -l. The sudo works fine with no password prompt when run locally. Jun 27, 2012 at 16:39
  • Ah, right - I wish you'd said that in your question.
    – user9517
    Jun 27, 2012 at 16:47
  • amended question so hopefully all the relevant facts are now in it Jun 28, 2012 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .