0

I set up a server to accept ssh without passwords, and it works fine for nonprivileged commands.
However, when I try to run sudo commands, I'm still asked for a password:

$ ssh -t test@192.168.1.52  "ls"
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
Connection to 192.168.1.52 closed.

$ ssh -t test@192.168.1.52  "sudo ls"
[sudo] password for test: 
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
Connection to 192.168.1.52 closed.
$

Googling seems to indicate that ssh -t should let sudo run without asking for a password, but this is not the case above.

Any suggestion what should I do to get sudo commands to work without asking for a password?

OS is CentOS 7.5.

| improve this question | |
  • 2
    You could set up the /etc/sudoers file with visudo to allow sudo to be used without a password. You can additionally set for which commands and which users/groups it applies to. This may give you a good lead. – Torin Oct 16 '18 at 17:22
  • @TorinCarey's comment should be the answer. – guzzijason Oct 16 '18 at 18:27
  • Thanks, @Torin. I was hoping for a solution not involving manually editing the sudoers file, as I need to set the sudo command over ssh without password, on quite a few servers (~50), and it would be a pain to repeatedly edit the sudoers file on each and every one of them. – boardrider Oct 16 '18 at 18:45
  • 1
    Then you should have your configuration management system do this (of course, it already has sudo without password). – Michael Hampton Oct 16 '18 at 19:34
2

Combining the excellent comments from Torin and Michael,

You must edit sudo configuration to allow commands that you want, optionally including the NOPASSWD: modifier.

Remember that:

  • These are privileged files, so you will need elevated credentials (root password, root ssh key, existing sudo rule...) to deploy this.
  • You can use the #includedir directive to include a directory of additional sudoers configs, such as /etc/sudoers.d. You can then drop in files such as with a custom software package you deploy.
  • You can maintain sudo rules in ldap rather than files. Although you probably have to touch all hosts to update nsswitch.conf. See the sudoers.ldap man page.

ssh -t relates to tty allocation, which is not directly related.

| improve this answer | |
0

Below command is the proper way for adding user to sudoers:

echo "test ALL = (root) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/test
chmod 0440 /etc/sudoers.d/test

Now you can ssh without disconnected.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.