Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to write an automated post-installation script in Bash (called post-install.sh, for instance). The script will automatically add and update repositories, install and update packages, edit config files, etc.

Now, if I execute this script, for instance with sudo post-install.sh, will I only be prompted for a sudo password once, or will I need to enter the sudo password on each invocation of a command inside the script, that needs sudo permission? In other words, do the commands inside the bash script 'inherit' the execution permissions, so to speak?

And, if they indeed do, is there still a possibility that the sudo permissions will time out (if, for instance, a particular command takes long enough to exceed the sudo timeout)? Or will the initial sudo password entrance last for the complete duration of whole script?

share|improve this question
3  
You may be interested to check out some tools specifically designed for this task. 3 common ones are: Puppet, chef, and ancible. –  spuder Feb 16 at 17:24
    
@spuder Thank you. Very helpful indeed. –  Decent Dabbler Feb 16 at 18:22

3 Answers 3

up vote 29 down vote accepted

Q#1: Will I only be prompted for a sudo password once, or will I need to enter the sudo password on each invocation of a command inside the script, that needs sudo permission?

Yes, once, for the duration of the running of your script.

NOTE: When you provide credentials to sudo, the authentication is typically good for 5 minutes within the shell where you typed the password. Additionally any child processes that get executed from this shell, or any script that runs in the shell (your case) will also run at the elevated level.

Q#2: is there still a possibility that the sudo permissions will time out (if, for instance, a particular command takes long enough to exceed the sudo timeout)? Or will the initial sudo password entrance last for the complete duration of whole script?

No they will not timeout within the script. Only if you interactively were typing them within the shell where the credentials were provided. Every time sudo is executed within this shell, the timeout is reset. But in your case they credentials will remain so long as the script is executing and running commands from within it.

excerpt from sudo man page

This limit is policy-specific; the default password prompt timeout for the sudoers security policy is 5 minutes.

share|improve this answer
4  
Excellent! Thank you. –  Decent Dabbler Feb 15 at 1:24
    
The answer to Q1 is "No, you will not be prompted again." –  dannysauer Feb 16 at 17:42
    
@dannysauer - read his Q again. I'm saying Yes to being prompted for password only once! –  slm Feb 16 at 22:35
    
The question says "is it a or b", and just saying "yes" didn't make it clear if it was "yes, a" or "yes, b". Just trying to clarify things for future readers. :D –  dannysauer Feb 17 at 3:02
    
@dannysauer - see update. –  slm Feb 17 at 3:05

bash and all of it child processes will run with superuser permissions. So you will not need to re-enter a password for commands in your bash script.

The sudo timeout only applies to (later) separate invocation of sudo. It would not affect your already running bash process, or any of its descendants.

share|improve this answer
1  
Good to hear! Thank you. –  Decent Dabbler Feb 15 at 1:24

These answers are all probably correct. However, this is not the generally-used way (as far as I am aware) to create bash scripts that require sudo permissions. Generally, at the top of the script you assume it hasn't been run with sudo permissions and instead call sudo -v yourself (which will prompt the user for their password) to 'set up' a sudo 'session'. You can either echo some explanatory text before the prompt, or override sudo's own prompt with the -p switch, to let the user know you need sudo access for some commands.

Then, in your script you should be fine to call sudo on the commands that require it (and only those commands that require it) without further password requests. If you think a certain group of commands that run together in your script (regardless of their own use of sudo) will extend beyond the sudo timeout, you can call sudo -v in the middle in order to issue a kind of 'keep-alive' the sudo 'session'.

If the sudo 'session' does happen to expire during the script, the user will simply be asked for their password the next time you issue a sudo command in the script.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.