Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I inherited this. Long story short I have an XML file that is calling a shell to run some commands. Everything I have tried has failed at the second su in the script. Here are some of the failure messages:

sudo: no tty present and no askpass program specified

Or

su: must be run from a terminal

Or

usage: sudo [-D level] -h | -K | -k | -V blah blah blah

Here is snippet of my script. It only fails at the second su attempt:

  <script language="shell"><![CDATA[
                  echo Doing some stuff
                  sudo -u adminuser /path/to/a/script/script
                  echo Emailing this stuff...
              su emailuser -c "mutt -e 'set content_type=text/html' -s 'Your stuff is ready' -- ${WHOEVER_PARAM_RECIPIENT} < /tmp/emailingstuff.html"
                ]]></script>

I've played around with permissions so much that I forgot where I was with them. Here they are currently in sudoers:

# See the man page for details on how to write a sudoers file

Defaults:emailuser !authenticate

adminuser ALL=NOPASSWD: /bin/su - emailuser
adminuser ALL=NOPASSWD: /bin/su emailuser
adminuser ALL=NOPASSWD: /usr/bin/sudo su emailuser

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
share|improve this question
3  
You know that XML is a markup language and not some sort of "scripting" language right? Why you must parse xml as script? –  Braiam May 29 at 17:22
add comment

1 Answer 1

Unless there is something in the su configuration that allows the user running these commands to run commands as emailuser with su, the command su emailuser -c … will prompt for emailuser's password. The use of sudo is always explicit.

Given your sudo rules, you probably wanted

sudo su emailuser -c …

But your sudo rules are strange: there's no point in authorizing sudo only to run su to yet another user. Change them to specify the target user, and forget about su.

scriptuser ALL = (adminuser) NOPASSWD: /path/to/a/script/script ""
scriptuser ALL = (emailuser) NOPASSWD: mutt

Note that since Mutt allows shell escapes, restricting the command as emailuser to mutt doesn't really increase security, but it may reduce accidental misuse. In your script, use

sudo -H -u emailuser mutt -e 'set content_type=text/html' -s 'Your stuff is ready' -- ${WHOEVER_PARAM_RECIPIENT} < /tmp/emailingstuff.html

Since you're calling sudo from a script, make sure that the requiretty flag is turned off in the sudoers file (it's off by default, but some distribution add it, despite the extremely limited circumstances where it could concievably improve security).

share|improve this answer
    
Thanks for the insight and helpful repsonse. I think I'm getting closer to the solution. I recreated the emailuser account. Removed all the sillyness from sudoers and now I get "su: must be run from a terminal." The other portion of the script executes fine. It's just the second su that is failing. Still stumped. –  mister mister May 29 at 18:23
    
@mistermister As I wrote in my answer, change your script to call sudo only, not su. –  Gilles May 29 at 18:23
    
Ah. That seems to be working. The last part of the issue is that mutt wont send the email because "/home/adminuser/sent is not a mailbox" –  mister mister May 29 at 19:23
    
I tried the command you provided as the adminuser and could not send the email. When I try it as the emailuser it works. This works outside of the script without sudo -u. Still stumped. –  mister mister May 29 at 19:51
    
@mistermister sudo doesn't set some environment variables, maybe mutt relies on one? In particular, sudo may or may not set HOME — add the -H option to force it so set HOME to the home directory of the target user. –  Gilles May 29 at 21:28
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.