I have a server running Debian Squeeze with the latest updates. I tried to set up the sudoers file to allow the user www-data execution of a specific shell-script as a specific user. I used visudo for this and added the line:

www-data ALL=(img) NOPASSWD: /path/to/script/imgsync.sh

Then I tried to call it as user www-data (I su-ed from root to www-data first):

sudo -u img /path/to/script/imgsync.sh

To my surprise, it still asks for a password:

[sudo] password for www-data:

I expected NOPASSWD: to take care of this?

What really puzzles me: I have another server with the same setup, where it works without password. Also, I have other similar permissions on the same server that also work without password.

I even added the line

Defaults:www-data       !authenticate

with visudo (just to test, I don't want this). Then, when I tried again, I got the (contradictory) error message:

Sorry, user www-data is not allowed to execute '/path/to/script/imgsync.sh' as img on servername.

How can I get make it execute without having to supply a password (and without giving any more rights to www-data)?


Turns out, nothing is wrong with the above setup. In my tests, the script encountered a directory where the user img lacked permissions, which caused the result as described.

While it all works now, I am still a bit unhappy about the unhelpful error message / behavior of dash (default non-login shell).

I'll leave the post, might be helpful to others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.