How to configure sudoers to allow running sudo command under other group and user name?

Question

How to configure sudoers to prevent having the Sorry, user ****** is not allowed to execute error message.

Background

For the purpose of testing how a python script under a less privileged user and group daemon account, there is a need to run:

$ sudo -u _denyhosts -g _denyhosts python /usr/local/bin/denyhosts.py 
-c /usr/share/denyhosts/denyhosts.cfg -n --purge --sync --verbose

The result is:

Sorry, user ****** is not allowed to execute 
'/usr/bin/python /usr/local/bin/denyhosts.py -c /usr/share/denyhosts/denyhosts.cfg 
-n --purge --sync --verbose' as _denyhosts:_denyhosts on ***.***.***.

The guess is that this command fails due to an extra configuration required in sudoers.

$ sudo -l
Matching Defaults entries for *** on this host:
    editor=/usr/bin/nano, env_reset, env_keep+=BLOCKSIZE, env_keep+="COLORFGBG
    COLORTERM", env_keep+=__CF_USER_TEXT_ENCODING, env_keep+="CHARSET LANG
    LANGUAGE LC_ALL LC_COLLATE LC_CTYPE", env_keep+="LC_MESSAGES LC_MONETARY
    LC_NUMERIC LC_TIME", env_keep+="LINES COLUMNS", env_keep+=LSCOLORS,
    env_keep+=SSH_AUTH_SOCK, env_keep+=TZ, env_keep+="DISPLAY XAUTHORIZATION
    XAUTHORITY", env_keep+="EDITOR VISUAL", env_keep+="HOME MAIL"

User *** may run the following commands on this host:
    (ALL) ALL

Already tried to add the group _denyhosts to sudoers by executing sudo visudo and inserting the line:

%_denyhosts    ALL=(ALL) ALL

Saving and trying again does not improve.

Answer 1

The line %_denyhosts ALL=(ALL) ALL means that users in the _denyhosts group are allowed to run any command as any user. This isn't what you're trying to do: you need to allow the user ****** to run commands as the user _denyhosts and the group _denyhosts. Something like:

****** ALL = (_denyhosts : _denyhosts) ALL

Answer 2

You'll need to ensure that even though users in _denyhosts has been added to the sudoers file, that the users you want to be able to execute this command are added to the group _denyhosts in /etc/group.

$ sudo vi /etc/group
*snip*
_denyhosts:x:###:username1,username2,username3

Save the the 'group' file and retry.