0

When I create new Ubuntu 12.10 instances, I typically bootstrap them by manually SSHing onto the machine and editing the sudoers to put a NOPASSWD on the default user (e.g., ec2-user, azureuser, etc.). Then my install scripts can sudo various commands without having to provide a password.

I don't have anything against passwords. It's just that when I try to do a password-based sudo over SSH using a bash script, sudo complains that there's no tty ("sudo: no tty present and no askpass program specified").

Also, I need this to be completely automated--it shouldn't require somebody to type in a password manually.

Few questions:

1) Is the approach here on the right track? In particular, is using NOPASSWD here a bad idea? I'm assuming that safeguarding the default user's SSH private key is fine here--just treat this account as a root account essentially.

2) If this is wrong, then how do I overcome the "no tty present" objection without having to manually enter passwords?

3) If NOPASSWD is OK, then how should I automate the sudoers edit? It seems that I need to use a password if only to sudo the visudo command.

I guess I could do all the work manually and then create a new image, but I'd rather just keep the base image and then script this stuff on if that's possible.

Improve this question
2
  • 3
    What about using a configuration management tool like puppet or chef to handle the job that the installation scripts are currently doing?
    – Shane Madden
    Commented Mar 15, 2013 at 0:28
  • I am in fact using Chef Solo to do this, but didn't necessarily want to complicate the question. There's a bootstrap phase where I do the visudo, and then I use a script to run the Chef Solo bootstrap (install Ruby, install Chef client).
    – user19509
    Commented Mar 15, 2013 at 4:14

1 Answer 1

Reset to default
0

Just a thought, but why not just permit root access over SSH with key-based authentication as in PermitRootLogin without-password.

If you have a requirement for a strong security setup, you can certainly fix this after the base install is done. But in my opinion the risk is extremely minimal to have key-based access to the root account setup for initial bootstrap period of the machine setup.

3) If NOPASSWD is OK, then how should I automate the sudoers edit? It seems that I need to use a password if only to sudo the visudo command.

Ubuntu Supports the includedir /etc/sudoers.d option. So your initial setup is very easy. Just something like this.

echo "adminuser ALL=NOPASSWD: ALL" > /etc/sudoers.d/boostrap
chmod 0400 /etc/sudoers.d/boostrap
Improve this answer
1
  • Thanks--I'm unfamiliar with PermitRootLogin so I'll investigate that option. I agree with you that the risk is minimal, especially in comparison to what I am doing. And also, yeah, I am in fact using that includedir mechanism as well--instead of visudo-ing i am just editing that file, but I need to sudo (or else login as root as you suggest). Thanks for the good ideas.
    – user19509
    Commented Mar 15, 2013 at 5:15

You must log in to answer this question.