2

Having a problem with sudo. As the user forge I want to be able to run sudo service php5-fpm reload without having to type a password. I've tried all of the variants below.

forge   ALL=NOPASSWD: /usr/bin/service php5-fpm reload
forge   ALL=NOPASSWD: /usr/bin/service
forge   ALL=(ALL:ALL) NOPASSWD: /usr/bin/service
forge   ALL=(ALL:ALL) NOPASSWD: /usr/bin/service php5-fpm reload

But it keeps prompting me for a password. Tried loggin in and out.

# tail /var/log/auth.log
Sep 16 09:28:19 apps sudo: pam_unix(sudo:auth): conversation failed
Sep 16 09:28:19 apps sudo: pam_unix(sudo:auth): auth could not identify password for [forge]

This is the whole file.

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

# User privilege specification
root    ALL=(ALL:ALL) ALL
#forge  ALL=NOPASSWD: /usr/bin/service

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Using Ubuntu 14.04.1 LTS

$ which service
/usr/sbin/service

The problem:

$ sudo service 
[sudo] password for forge: 

This is what worked.

visudo:

# Cmnd alias specification
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig/, /usr/bin/service, /usr/sbin/service

/etc/sudoers.d/forge:

forge   ALL = (ALL) NOPASSWD:   SERVICES

Tried to move the content of the forge file into visudo, but that didn't work.

  • What does the system log indicate? – mdpc Sep 15 '14 at 19:55
  • Are you editing the file via visudo and not directly? Are the permissions on the sudoers files ok? You might want to provide the whole file as there might be something that is preventing what you are expecting. – mdpc Sep 15 '14 at 19:56
  • -r--r----- 1 root root /etc/sudoers. Editing by visudo. – Znarkus Sep 16 '14 at 7:27
  • You don't say which UNIX/distro you're using, but on mine (Linux / CentOS and Fedora), service is /sbin/service. Could you cut-and-paste into your question the output of which service, and perhaps an example of the failure so we can see exactly how you're invoking it? – MadHatter Sep 16 '14 at 7:49
  • @MadHatter Updated. – Znarkus Sep 16 '14 at 8:41
1

Try following:

/etc/sudoers:

# grep -B1 'Cmnd_Alias SERVICES' /etc/sudoers
## Services
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
# 

/etc/sudoers.d/forge:

# cat /etc/sudoers.d/forge
forge   ALL = (ALL) NOPASSWD:   SERVICES
# 

test

[forge@localhost ~]$ sudo service
Usage: service < option > | --status-all | [ service_name [ command | --full-restart ] ]
[forge@localhost ~]$ 

Adjust CORRECT path to your service if needed, this may vary depends on your distribution, to find correct path run following:

$ which service
/sbin/service
$ 
  • Hmmm....this does not really look any different than what the user had but in a different format. – mdpc Sep 15 '14 at 19:55
  • @mdpc different format that WORKS (see my test) – alexus Sep 15 '14 at 21:01
  • Didn't work for me. Still prompting me for a password. – Znarkus Sep 16 '14 at 7:46
  • Got it to work now with Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig/, /usr/bin/service, /usr/sbin/service – Znarkus Sep 16 '14 at 9:03
2

You're giving the wrong PATH to the binary. The which output shows that it's /usr/sbin/service, but you keep specifying /usr/bin/service in your sudoers entries.

Try

forge   ALL=(ALL)     NOPASSWD: /usr/sbin/service
  • It still prompts me for a password, both for sudo /usr/sbin/service and sudo service. – Znarkus Sep 16 '14 at 9:00
  • Don't just tell us; show us - we need to see the relevant sudoers entry at the time of the sample output. – MadHatter Sep 16 '14 at 9:03
  • Updated the Q with what worked. – Znarkus Sep 16 '14 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.