How can I use `sudo` with a command, but still “be myself”?

Question

My SysAdmin is requiring me to use sudo to run a certain script. This script (depending on which subcommand you pass in as an argument) connects to another machine using ssh keys, but this is failing, presumably because it is run as root and not as me.

How can I still use sudo (which my sysadmin requires and which I don't have the power to change) to gain the privileges to run the script, and yet make the command run with access to my ssh keys?

Answer 1

Two things spring to mind. First, edit the script so that only the commands that need elevated privileges are run with sudo. This should allow your ssh connection to work. This has the advantage of running with elevated privileges only those commands that need it. Run the command without sudo on the commandline, relying on the fact the sudo calls in the script will do the right thing.

Second, edit the script so that it explicitly sets the name of the user to connect as. You can use the $SUDO_USER variable, which holds the user name of the user that started the current sudo session. This should do the trick:

ssh "${SUDO_USER}@remotehost.example.com"

Answer 2

The user id will always change with sudo, but you can preserve your environment with the -E parameter.

Answer 3

Depending on how sudo has been configured, it may overwrite most environment variables. In particular, it is likely that it overwrites SSH_AUTH_SOCK, and it might overwrite HOME. That's not something you can fix without changing the sudo configuration.

You can see the sudo configuration (and in particular which environment variables are preserved) by running sudo -V as root. It is a feature that you cannot see the configuration as an unprivileged user.

It is possible that your system administrator has locked down your sudo permissions so that the script cannot use your ssh keys. This could be a security policy, and if it is implemented correctly, then by definition you cannot fix it by yourself, you will need your sysadmin to change the configuration.

It's difficult to know what is needed without knowing what the script does and what the sudo configuration is. Perhaps a sudoers line like the following might help (it tells sudo to preserve the SSH_AUTH_SOCK environment variable if the command to run is /path/to/script):

Defaults!/path/to/script env_keep+=SSH_AUTH_SOCK

If the script runs as a user who is neither you nor root, you will have to give that user permission to read your keys or access your agent.