78
votes
Accepted
Why can I update a file owned by root using sudo vi, but not append a line to it with sudo echo "Thing" >> file?
Sudo elevates the process it calls, it does not elevate any of the current shell's processing like redirection, globbing, etc.
The file redirection >> /etc/httpd/conf.d/vhosts.conf is being ...
- 131k
50
votes
Accepted
Why does password entering work in a piped sudo command?
Actually, a typical invocation of sudo does not read the password from stdin at all. Instead, sudo will directly access the controlling terminal (a tty or pty, via the /dev/tty special file) and ...
- 1,556
42
votes
Running Ansible task as a specific user
Note that after Ansible 1.9, the sudo wording was replaced with become, thus
sudo: yes
sudo_user: some_user
becomes (pun intended):
become: yes
become_user: some_user
See more specifics here: https:/...
- 521
28
votes
Accepted
How do I list virsh networks without sudo?
It appears that:
If not explicitly stated, the virsh binary uses the 'qemu:///session' URI
(at least under debian).
Therefore, not only virsh net-list, but practically any command, including ...
- 2,275
28
votes
Accepted
sudo not working on certain commands
The problem is the dot in update-rc.d (in /etc/sudoers.d/update-rc.d); from man sudo:
The #includedir directive can be used to create a sudo.d directory that the system package manager can drop ...
- 80.1k
25
votes
sudo rejects password that is correct
Another possible cause is that systemd-homed is not running. Check it's status with
systemctl status systemd-homed
If it says something other than active, use
systemctl start systemd-homed
to start ...
- 359
24
votes
Accepted
Linux: set up for remote sysadmin
The only thing that comes to mind would be to add --expiredate to the adduser call.
With that the customer knows that your access will automatically expire at a fixed date.
He still needs to trust ...
- 17.6k
23
votes
How can I implement ansible with per-host passwords, securely?
Using pass is a simple method to provide ansible with sudo passwords. pass stores one password per file which makes it easy to share passwords via git or other methods. It’s also secure (using GnuPG) ...
- 411
22
votes
Accepted
Sudo directive in /etc/sudoers.d doesn't work (but it's fine if it's in /etc/sudoers)
I found out the problem - for files in /etc/sudoers.d, the file must not end at the directive, but on a new line. This is most easily shown with cat -A.
Invalid file:
root@server:/etc/sudoers.d# ...
- 954
21
votes
Securely use find with sudo
According to man 7 capabilities
CAP_DAC_READ_SEARCH
* Bypass file read permission checks and directory read and execute permission checks;
* Invoke open_by_handle_at(2).
This ...
- 23.4k
21
votes
Accepted
Is it insecure to have an ansible user with passwordless sudo?
If the service account can do passwordless sudo, then you have to protect access to that account.
Having the account not have a password, and using only ssh keys to log in to it, accomplishes this, ...
- 246k
19
votes
Accepted
Securely use find with sudo
What about locate?
locate reads one or more databases prepared by updatedb(8) and writes
file names matching at least one of the PATTERNs to standard output,
one per line. If --regex is not ...
- 5,240
16
votes
How do I list virsh networks without sudo?
uncomment this line in file /etc/libvirt/libvirt.conf
uri_default = "qemu:///system"
was enough for me in fedora 29 .
Edit: as it says here https://libvirt.org/uri.html for non root users that file ...
- 161
16
votes
Linux: set up for remote sysadmin
You can record your sessions with the script(1) utility.
$ script session.log
Script started, file is session.log
$ ls
file1 session.log
exit
Script done, file is session.log
then everything is in ...
- 116k
16
votes
root login or sudo user for server administration?
One thing to consider: If using SSH keys for remote authentication, what happens if the private key is compromised?
If root: root access is compromised. Hope you weren't using that key for root access ...
- 596
13
votes
Accepted
Parse error in sudoers file
A "sudo: parse error in ..." originating from /etc/sudoers or any of the files included with either the #include <filename> or #includedir <path> directives may be caused by a missing new-...
- 78.7k
12
votes
Accepted
root login or sudo user for server administration?
The other users already mentioned very good points. I want to recap the ones I think are most important...
...why to use sudo
If your ssh key for root-login is compromised, you have little chance to ...
- 178
11
votes
Accepted
Centos 7 - adding a user to sudoers group - still is not in the sudoers file - why?
My experience is that 'user' needs to log out and in again. Try the 'id' command to see if the system thinks that 'user' is in the wheel group or not.
- 306
11
votes
Accepted
Is it possible to lock sudo from the command line, without editing sudoers or logging out and back in?
You can do this with the sudo -K or -k options:
-K, --remove-timestamp
Similar to the -k option, except that it removes the user's cached credentials entirely and may not be used in conjunction with ...
- 3,057
10
votes
Why does password entering work in a piped sudo command?
The pipe connects sudo cat's stdout to less's stdin, so sudo cat's stdin is unaffected, and able to receive the password.
As for the prompt, it goes out on sudo cat's stderr; in bash, try redirecting ...
- 80.1k
10
votes
Accepted
sudo mv fails with "Operation not permitted"
Must be due to the flags - try sudo chflags nouchg /usr/bin/php
EDIT:
You need to press Cmd + R at boot time, open the terminal and then run csrutil disable and reboot.
- 913
9
votes
Accepted
Setting password on sudo su for Amazon EC2 Instance
If you have a line like
ALL ALL=(ALL) NOPASSWD:ALL
in /etc/sudoers, this will allow all users to sudo without being prompted for passwords. If you uncomment this line you will have to specify which ...
- 477
9
votes
"user is not in the sudoers file" despite user belonging to group wheel
The wheel entry in the sudoers file is commented out, so the group wheel has no sudo access at all.
Remove the # from the line:
%wheel ALL=(ALL) ALL
- 24.2k
9
votes
linux command found but not found when using sudo
Sudo is not using the same PATH as your current user for security reasons. In /etc/sudoers there is an option secure_path which specifies the path used when running commands with sudo.
Mine looks like ...
- 635
9
votes
Checking sudoers.d files with Ansible
Have you tried this:
- copy:
src: '{{ item }}'
dest: '/etc/sudoers.d/{{ item }}'
owner: root
group: root
mode: 0440
validate: 'bash -c "cat /etc/sudoers %s | visudo -cf-"'
It ...
- 211
9
votes
Accepted
How to switch user given a UID?
Look up the username with the id command, e.g.:
id -un 1003
Then put it together with command substitution:
su - $(id -un 1003)
- 246k
9
votes
root login or sudo user for server administration?
For all uses, I strongly suggest you to not use root; even to disable it if possible. I routinely have root disabled on Linux/UNIX servers. Root user cannot be fenced, its actions are not logged. At ...
- 1,575
8
votes
Setting up SSH with the correct user rights
No, you should not.
If you were to type "su", then that would be true, you should be asked for the root password. Su basically means "switch user".
Sudo authenticates the logged in user again to ...
- 7,107
8
votes
Accepted
Can sudo affect the entire server or just the users account?
When you invoke sudo (without an explicit user argument), you are effectively root for the duration of that command. If the command launches a new shell, all commands run from that shell are also root....
- 16.8k
Only top scored, non community-wiki answers of a minimum length are eligible