I am on a CIS-hardened RHEL 8 host on an AWS EC2 instance. My goal is to permit my user to run some commands with sudo passwordless (e.g. ls, cat, ...), while other commands (like vi) should stay password-protected.

I have added the following line to /etc/sudoers.d/99-foo, which is being included by /etc/sudoers:

myuser ALL=(ALL) NOPASSWD: /usr/sbin/visudo,/usr/bin/ls

(I have just locked myself out, hence the visudo...)

This works just fine for the specified commands:

[myuser@myhost ~]$ sudo ls -l /var/log/httpd/access_log | wc -l

However, all other commands - which I still want to work with password protection! - fail now:

[myuser@myhost ~]$ sudo echo "hello stackexchange!"
[sudo] password for myuser:
Sorry, user myuser is not allowed to execute '/bin/echo hello stackexchange!' as root on myhost.
  • 1
    What are the settings in /etc/sudoers ? Specifically, is wheel allowed to execute all commands? If so, is your user account in the wheel group? – llywrch Sep 9 '20 at 15:41
  • Run sudo -l to see a list of commands that sudo thinks you have access to. If it's not listed in the output, you can't run it. – James Sneeringer Sep 9 '20 at 17:59

In addition to the rule that allows passwordless sudo for specific commands, you also need some other sudo rule which allows your user to run ALL commands with sudo.

The default sudo config allows users in the wheel group to run ALL commands with sudo (after supplying a password) and users who should have such access should be placed in this group.

# usermod -aG wheel myuser

If the user is logged in when added to a group, they must log out and log back in before this change takes effect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.