3

Is it possibile to configure sudo to ask for root password instead of user password?

The server is configured with a root user and a simple user (let's call him simple) with limited privileges, used to deploy all the applications hosted on the server. The user simple is not in the sudoers list thus

$ sudo command

won't work because simple's password can't grant him root privileges.

Occasionally I need to run some scripts which need root access via Capistrano (a ruby deployment tool) and it's quite difficult to code a script in order to login as root, run the script, then logout. I'd like to be able to execute the following statement

$ sudo god restart tasks-group

and have Capistrano to prompt me for root password. Currently, Capistrano prompts for deployment user password which is, obviously, a non admin account.

Improve this question

4 Answers 4

Reset to default
11

I think you're trying to make sudo work in a way that it is not ment to - you don't want to add the 'simple' user to the sudoers file (please correct me if i'm wrong).

In that case sudo isn't the tool you want to use you want to issue su -c <command> this will prompt for the root password, execute the command, then exit.

Improve this answer
4

There's a flag to be set in the sudoers file if you want the user to authenticate via his own password, or via root's. The flag is called rootpw. Sudo is a very powerfull package, be sure to check the man page about sudoers(5).

Improve this answer
1
  • 2
    See also information in man sudoers regarding targetpw and Runas.
    – Dennis Williamson
    Jan 18, 2010 at 23:38
3

No. Use su to become root using the root password.

The better solution is probably to have capistrano use sudo on the deployment machine for tasks that need root access.

Improve this answer
2
  • This requires the user to be included in the sudoers list. I wanted to avoid this configuration because the user can login from ssh.
    – Simone Carletti
    Jan 18, 2010 at 21:17
  • 3
    But on the other hand you can add just the relevant commands to sudoers, thus limiting what the non-admin user can do. I think that this, on the whole, is more secure than involving the actual root password.
    – Jakob Borg
    Jan 18, 2010 at 21:28
0

If the deployment user is allowed to sudo, then at that point it does become a privileged account that can act in an administrative fashion. That's the purpose of sudo. Or am I misreading the question?

Improve this answer
3
  • This is the point. The deployment user is not in the sudoers list.
    – Simone Carletti
    Jan 18, 2010 at 21:16
  • Ok. You might want to edit that into your question, then. Sorry, was't clear (at least to me).
    – squillman
    Jan 18, 2010 at 21:22
  • Updated. Sorry for the misunderstanding.
    – Simone Carletti
    Jan 18, 2010 at 21:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .