Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I run the script containing su -m user service userservice start under root user, I do not need to enter the password. But when I run it under user user, it asks passwords all the time. That really bugs me. Is it supposed to ask passwords for security reasons? Is there any way I could avoid asking password if su -m user command is run under user?

Edit1: The reason I need to avoid password entering on su for current user is /etc/init.d/scripts which have su -m user statement for many services I have installed. And it is seems stupid to enter password every time if I'm restarting service which is supposed to run under current user. Actually, I need to enter password twice while I'm restarting some service. I might agree that it is a feature of some init.d scripts and all I need to do is tweak the source a little bit, but I thought that it might be fixed somehow on the su level in order to avoid changing init.d scripts source code.

share|improve this question
1  
I suggest your script discover whether it's already running as user and only perform su if necessary. –  user24222 Oct 4 '12 at 9:37

2 Answers 2

Yes, security is the reason and no, su has no way of circumventing that. But there is sudo, which can be used for what you want and it has a configuration file where you can disable the need to enter a password.

It also allows for complex configurations so that you can disable the need for a password for a very specific command only, to not fully void security.

su mostly uses pam for authentication and you could modify your /etc/pam.d/su and add a line

auth sufficient pam_succeed_if user = <put username here> quiet

With that line added you shouldn't have to enter a password, when running su as the specified user.

share|improve this answer
    
Actually its not su doing this. It's pam (well, assuming the system uses PAM). And you can probably change the pam config to avoid it. –  derobert Oct 4 '12 at 17:56
    
Exactly, so su has no way of circumventing that. sudo is built for exactly what the OP want's to do, so he should rather use that then starting to fiddle with su's pam config. –  Bananguin Oct 5 '12 at 10:51

First off, that you want to do a su to yourself is really weird. It makes me worry that you've misunderstood something fundamental, as I'm having a hard time coming up with a reason why you'd ever need to do this.

Second, su's password prompting is actually controlled by PAM (as is most password prompting) if your system uses PAM. Certainly, all major Linux distros do. For example, here is the top of /etc/pam.d/su from my Debian machine:

#
# The PAM configuration file for the Shadow `su' service
#

# This allows root to su without passwords (normal operation)
auth       sufficient pam_rootok.so

That first uncommented line is why root is not asked for a password. If you commented it out, root would be prompted for a password (and you'd probably break a lot of scripts!).

I don't know of a default pam module intended to compare the current and destination user, but you could use pam_exec.so to do it. Something like this (which, I confess, I'm unsure of the security implications of):

auth       sufficient pam_exec.so seteuid quiet /usr/local/sbin/pam-same-user

where /usr/local/sbin/pam-same-user is a script like:

#!/bin/sh

[ "$PAM_USER" = "$PAM_RUSER" ]

Once again, I'd like to stress I'm unsure of the security implications of this.

share|improve this answer
    
the reason I need to avoid password entering on su for current user is /etc/init.d/scripts which have su -m user statement for many services I have installed. and it is seems stupid to enter password every time if I'm restarting service under current user. actually, I need to enter password twice while I'm restarting some service. I might agree that it is a feature of some init.d scripts, but I thought that it might be fixed somehow on the su level in order to avoid changing source code of init.d scripts. –  altern Oct 6 '12 at 7:00
    
@altern I'd suggest just using sudo for that. Grant whichever user access to run service *whatever* restart (etc.) as root, without a password prompt. Then just use sudo service *whatever* restart. –  derobert Oct 8 '12 at 14:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.