Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How to configure sudoers to prevent having the Sorry, user ****** is not allowed to execute error message.

Background

For the purpose of testing how a python script under a less privileged user and group daemon account, there is a need to run:

$ sudo -u _denyhosts -g _denyhosts python /usr/local/bin/denyhosts.py 
-c /usr/share/denyhosts/denyhosts.cfg -n --purge --sync --verbose

The result is:

Sorry, user ****** is not allowed to execute 
'/usr/bin/python /usr/local/bin/denyhosts.py -c /usr/share/denyhosts/denyhosts.cfg 
-n --purge --sync --verbose' as _denyhosts:_denyhosts on ***.***.***.

The guess is that this command fails due to an extra configuration required in sudoers.

$ sudo -l
Matching Defaults entries for *** on this host:
    editor=/usr/bin/nano, env_reset, env_keep+=BLOCKSIZE, env_keep+="COLORFGBG
    COLORTERM", env_keep+=__CF_USER_TEXT_ENCODING, env_keep+="CHARSET LANG
    LANGUAGE LC_ALL LC_COLLATE LC_CTYPE", env_keep+="LC_MESSAGES LC_MONETARY
    LC_NUMERIC LC_TIME", env_keep+="LINES COLUMNS", env_keep+=LSCOLORS,
    env_keep+=SSH_AUTH_SOCK, env_keep+=TZ, env_keep+="DISPLAY XAUTHORIZATION
    XAUTHORITY", env_keep+="EDITOR VISUAL", env_keep+="HOME MAIL"

User *** may run the following commands on this host:
    (ALL) ALL

Already tried to add the group _denyhosts to sudoers by executing sudo visudo and inserting the line:

%_denyhosts    ALL=(ALL) ALL

Saving and trying again does not improve.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

The line %_denyhosts ALL=(ALL) ALL means that users in the _denyhosts group are allowed to run any command as any user. This isn't what you're trying to do: you need to allow the user ****** to run commands as the user _denyhosts and the group _denyhosts. Something like:

****** ALL = (_denyhosts : _denyhosts) ALL
share|improve this answer
add comment

You'll need to ensure that even though users in _denyhosts has been added to the sudoers file, that the users you want to be able to execute this command are added to the group _denyhosts in /etc/group.

$ sudo vi /etc/group
*snip*
_denyhosts:x:###:username1,username2,username3

Save the the 'group' file and retry.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.