I have the following in my sudoers.d/nginx file:

deployer ALL=NOPASSWD: /etc/init.d/nginx reload

This works if I run the command as sudo:

$ sudo /etc/init.d/nginx start
[sudo] password for deployer: 
Sorry, user deployer is not allowed to execute '/etc/init.d/nginx start' as root on graduation.

However, when I run the command as non-sudo, it seems as if sudoers gets passed. The command still doesn't work, but that is because of other ownership errors, not the restriction in sudoers:

$ /etc/init.d/nginx start
nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
2012/12/30 20:59:49 [warn] 30054#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:12
2012/12/30 20:59:49 [emerg] 30054#0: open() "/var/log/nginx/access.log" failed (13: Permission denied)

Is this expected behaviour? And if so, why is this happening? I would expect the sudoers verification to happen before running a command. Do sudoers rules only apply to commands run as sudo? (makes sense, given its name).

And if this is the case, are there any other ways to restrict regular access to commands without using sudo?

Basically I would like my deployer user to do only two things:

  • own its home directory /var/www
  • be able to execute /etc/init.d/nginx reload

All other things should be off-limits (ideally even cd'ing outside the home directory)

  • 1
    Have you noticed that the sudoers file allows reload only while you tried start?
    – ott--
    Dec 30, 2012 at 20:31
  • @ott-- not sure what you mean, but the above does work correctly when using sudo. I am allowed to execute reload and get the correct error when using start: Sorry, user deployer is not allowed to execute '/etc/init.d/nginx start' as root on hostname.
    – JeanMertz
    Dec 30, 2012 at 22:20

1 Answer 1


This is expected behaviour, the sudoers file is only consulted when you run sudo so it denies the user access to the command and gives you the relevant error message.

When the user tries to run the command directly, sudo is not involved so you get the error messages produced by the individual commands failing because the user lacks privilege.

If you want to restrict the user to just one activity then you could allow them to log in via ssh and tie their keys to to the single command by using

command="/usr/bin/sudo /etc/init.d/nginx reload" ssh-rsa AAAAB3NzaC1...

With this configuration when the user logs in then the reload is performed and they are logged out.

If, at a later date, you decide that you need the user to carry out other operations then you can extend this idea.

  • Thank you for this explanation. I expected as much. This makes perfect sense. Restricting SSH possibilities seems like a nice solution, if maybe a bit too restrictive.
    – JeanMertz
    Dec 30, 2012 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .