Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How do you set a password to execute a command or script in Linux?

I need to avoid a script (in which user and password details are included) from being used/executed from unauthorized users. So is there any way to set password to execute a particular script.

share|improve this question
    
I'm missing environmental information here. Would a script calling another script make it? Kinda Python compiled script for a bit of security by obscurity? –  galegosimpatico Jul 9 '13 at 7:13
1  
@uprego - bad idea. Use sudo, obscurity != security! –  slm Jul 9 '13 at 7:24
    
@slm - bad myth. Security by obscurity is a valid approach when being a trustable environment and or is just about preventing naïve users damage things. I said environmental information was missing. –  galegosimpatico Jul 9 '13 at 7:32
5  
@uprego - not a myth at all. People can do what they want so long as they understand the tradeoffs. In this scenario there is a perfectly good choice already provided by most modern Linux installations, sudo. –  slm Jul 9 '13 at 7:39

2 Answers 2

Sudo might be the way to go.

Have your script owner and executable by a specific user and don't allow access from other users, 700 permissions for example.

Second, edit your sudoers file using visudo and add a line as the following:

%your_group ALL=path_to_script/script

All the users that are capable of running the script have to be added to your_group.

So, whoever is not part of your_group won't be able to run the script. The alternative can be for you to specific just the username.

username ALL=path_to_script/script
share|improve this answer
3  
You typically shouldn't edit your /etc/sudoers file directly, use the tool visudo to do edits. –  slm Jul 9 '13 at 7:22
    
updated the answer with the tools for editing. thanks @slm –  BitsOfNix Jul 9 '13 at 7:42
    
You should only use visudo to edit /etc/sudoers. sudoedit won't check the file's syntax. –  paraxor Jul 9 '13 at 11:27
    
guess I got lucky with sudoedit without breaking it, updated answer. thanks –  BitsOfNix Jul 9 '13 at 11:35
    
The question as asked doesn't call for or benefit from sudo: to keep credentials away from certain users, all it takes is to not give them read permission on the file that contains the credentials. –  Gilles Jul 10 '13 at 1:27

You need to ensure that the password is only readable by authorized users. Don't store the password in the script, store it in a separate file that you read from the script. It's a lot easier to manage permissions this way. If you store credentials in the script, it's hard to be sure where they'll end up: they may be inadvertently copied around, they should be entered in version control, etc.

Separating the credentials from the script has a second and arguably more important benefit. It separates “permission to execute the script” from “permission to access the resource”, which is good, because you aren't really trying to prevent people from executing your script, you're trying to prevent people from accessing the resource. So set the permissions on the password file accordingly, and you'll be set.

The easy way to manage permissions is to create a group and put the users who are allowed to access the resource in that group. Let's call the group seniors, and say that users alice and bob are allowed to access the resource. Create a group called seniors (e.g. addgroup seniors), and add the users to the group (e.g. adduser alice seniors; adduser bob seniors). Make the password file owned by the group seniors and readable only by the group.

chgrp seniors password.txt
chmod u=rw,g=r,o= password.txt    # or chmod 640 password.txt for short

Maybe you want some users to be able to execute the script but not to have arbitrary access to the resource. You don't mention this in your question, but I'll explain how it can be done just in case.

Suppose that the users charlie and dominique must be able to execute that particular script, but not access the resource otherwise. Create a group called juniors and put these users into this group. (You don't actually need to create a group but it makes management easier.) Create a sudo rule that allows users in the group juniors to obtain the permissions of the group seniors, but only to execute one specific program — the script that reads the password file. Run visudo to add this line to the sudoers file:

%juniors ALL = (:seniors) /path/to/script ""

The juniors can execute the script by calling sudo -g seniors /path/to/script. The script will then run with the additional privileges conferred by the group seniors. Nonetheless the user who called sudo will not be able to access the password file (unless the script is buggy and can be tricked to leak it).

Note again that sudo is only useful if you need some people to be able to access the resource without knowing the password. It won't do anything for you if all you want is to restrict access to the password to certain users, and not allow anyone else to access the resource.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.