Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to configure sudoers to prevent having the Sorry, user ****** is not allowed to execute error message.


For the purpose of testing how a python script under a less privileged user and group daemon account, there is a need to run:

$ sudo -u _denyhosts -g _denyhosts python /usr/local/bin/denyhosts.py 
-c /usr/share/denyhosts/denyhosts.cfg -n --purge --sync --verbose

The result is:

Sorry, user ****** is not allowed to execute 
'/usr/bin/python /usr/local/bin/denyhosts.py -c /usr/share/denyhosts/denyhosts.cfg 
-n --purge --sync --verbose' as _denyhosts:_denyhosts on ***.***.***.

The guess is that this command fails due to an extra configuration required in sudoers.

$ sudo -l
Matching Defaults entries for *** on this host:
    editor=/usr/bin/nano, env_reset, env_keep+=BLOCKSIZE, env_keep+="COLORFGBG
    LC_NUMERIC LC_TIME", env_keep+="LINES COLUMNS", env_keep+=LSCOLORS,
    env_keep+=SSH_AUTH_SOCK, env_keep+=TZ, env_keep+="DISPLAY XAUTHORIZATION
    XAUTHORITY", env_keep+="EDITOR VISUAL", env_keep+="HOME MAIL"

User *** may run the following commands on this host:
    (ALL) ALL

Already tried to add the group _denyhosts to sudoers by executing sudo visudo and inserting the line:

%_denyhosts    ALL=(ALL) ALL

Saving and trying again does not improve.

share|improve this question
up vote 0 down vote accepted

The line %_denyhosts ALL=(ALL) ALL means that users in the _denyhosts group are allowed to run any command as any user. This isn't what you're trying to do: you need to allow the user ****** to run commands as the user _denyhosts and the group _denyhosts. Something like:

****** ALL = (_denyhosts : _denyhosts) ALL
share|improve this answer

You'll need to ensure that even though users in _denyhosts has been added to the sudoers file, that the users you want to be able to execute this command are added to the group _denyhosts in /etc/group.

$ sudo vi /etc/group

Save the the 'group' file and retry.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.