Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm developing an application that will run on an Amazon EC2 instance, and execute certain commands that require root access. The problem is that different VM's give root access in different ways. E.g. some VM's give direct access to the root account, while others will simply allow a default non-root user access to sudo.

Now, I can easily solve the above example by adding an option to prepend "sudo " to all commands. However, I'm not very familiar with unix, and I'd like to know if there are any other ways of gaining root privileges that I should prepare my program for. Are su and sudo reasonably enough?

share|improve this question

migrated from stackoverflow.com Jul 11 '11 at 20:48

This question came from our site for professional and enthusiast programmers.

1  
belongs to ServerFault or to Linux&Unix SE site –  genesis Jul 11 '11 at 18:02

3 Answers 3

up vote 2 down vote accepted

There are several sudo-like tools (calife, op, super, …) — see How do I run a command as the system administrator (root) — but you could spend your life on unix systems without encountering them (they've all been displaced by sudo). In practice, if you need to call scripts as root, either arrange for all your machines to have passwordless sudo, or to allow ssh logins as root. There's not much of a security difference between the two: either way, the script must have all the credentials necessary to reach the root account.

If you only want your scripts to be able to execute specific commands, use specific entries for these commands in /etc/sudoers, or specific keys with a command= line in ~root/.ssh/authorized_keys.

share|improve this answer

If you are attempting to run a command from a script, pass the -t option to ssh:

ssh -i file.pem -t myhost “sudo -n myscript”

The -n option to sudo will prevent sudo from prompting for a password; if the command requires a password you’ll get an error.

It worked for accessing EC2 instances.

share|improve this answer
  • POSIX file systems generally implement the setuid/setgid bits. This is never recommended because it can hardly be made secure, but it does work:

.

  cp /usr/bin/id /tmp/rootid
  sudo chown root /tmp/rootid
  sudo chmod u+s /tmp/rootid
  /tmp/rootid

watch closely for the euid field

  • sudo and su work; beware of sudo -E, or su - interactions with environments. Perhaps it is best to explicitely wrap all your su calls iwth env -i to be isolated from harm

  • Solaris has RBAC allthough OpenSolaris used to have a sudo package for compatibility

share|improve this answer
    
As I recall, setuid root works only for binaries, not for shell scripts. Is that right? –  Lorin Hochstein Jul 11 '11 at 21:05
    
Be aware, though, that at least on Linux (not sure about other *nixes), a file system may be mounted nosuid which will make the setuid bit have no effect. –  Michael Kjörling Jul 11 '11 at 21:06
1  
@lorin Allow setuid on shell scripts –  Gilles Jul 11 '11 at 21:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.