When I create new Ubuntu 12.10 instances, I typically bootstrap them by manually SSHing onto the machine and editing the sudoers to put a NOPASSWD on the default user (e.g., ec2-user, azureuser, etc.). Then my install scripts can sudo various commands without having to provide a password.

I don't have anything against passwords. It's just that when I try to do a password-based sudo over SSH using a bash script, sudo complains that there's no tty ("sudo: no tty present and no askpass program specified").

Also, I need this to be completely automated--it shouldn't require somebody to type in a password manually.

Few questions:

1) Is the approach here on the right track? In particular, is using NOPASSWD here a bad idea? I'm assuming that safeguarding the default user's SSH private key is fine here--just treat this account as a root account essentially.

2) If this is wrong, then how do I overcome the "no tty present" objection without having to manually enter passwords?

3) If NOPASSWD is OK, then how should I automate the sudoers edit? It seems that I need to use a password if only to sudo the visudo command.

I guess I could do all the work manually and then create a new image, but I'd rather just keep the base image and then script this stuff on if that's possible.

  • 3
    What about using a configuration management tool like puppet or chef to handle the job that the installation scripts are currently doing? – Shane Madden Mar 15 '13 at 0:28
  • I am in fact using Chef Solo to do this, but didn't necessarily want to complicate the question. There's a bootstrap phase where I do the visudo, and then I use a script to run the Chef Solo bootstrap (install Ruby, install Chef client). – Willie Wheeler Mar 15 '13 at 4:14

Just a thought, but why not just permit root access over SSH with key-based authentication as in PermitRootLogin without-password.

If you have a requirement for a strong security setup, you can certainly fix this after the base install is done. But in my opinion the risk is extremely minimal to have key-based access to the root account setup for initial bootstrap period of the machine setup.

3) If NOPASSWD is OK, then how should I automate the sudoers edit? It seems that I need to use a password if only to sudo the visudo command.

Ubuntu Supports the includedir /etc/sudoers.d option. So your initial setup is very easy. Just something like this.

echo "adminuser ALL=NOPASSWD: ALL" > /etc/sudoers.d/boostrap
chmod 0400 /etc/sudoers.d/boostrap
  • Thanks--I'm unfamiliar with PermitRootLogin so I'll investigate that option. I agree with you that the risk is minimal, especially in comparison to what I am doing. And also, yeah, I am in fact using that includedir mechanism as well--instead of visudo-ing i am just editing that file, but I need to sudo (or else login as root as you suggest). Thanks for the good ideas. – Willie Wheeler Mar 15 '13 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.