I am on a CIS-hardened RHEL 8 host on an AWS EC2 instance. My goal is to permit my user to run some commands with
sudo passwordless (e.g.
cat, ...), while other commands (like
vi) should stay password-protected.
I have added the following line to
/etc/sudoers.d/99-foo, which is being included by
myuser ALL=(ALL) NOPASSWD: /usr/sbin/visudo,/usr/bin/ls
(I have just locked myself out, hence the
This works just fine for the specified commands:
[myuser@myhost ~]$ sudo ls -l /var/log/httpd/access_log | wc -l 1
However, all other commands - which I still want to work with password protection! - fail now:
[myuser@myhost ~]$ sudo echo "hello stackexchange!" [sudo] password for myuser: Sorry, user myuser is not allowed to execute '/bin/echo hello stackexchange!' as root on myhost.