Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need to deploy my app to server called lovelyplace by a Fabric script. Unfortunately, the server's setup is horrible, but I can do nothing about it - I have to live with it.

There is one non-root user I can use for ordinary stuff, let's name her alice. Then there is another user, let's name him bob. bob has root privilegies. The admin who prepared the server installed all stuff to places where one can operate only as root, so bob is needed for practically everything I do.

I have a password only for alice's account. I have no password for bob, but I was told I can use his powers by typing sudo su - bob and then doing stuff. And that's true - in a shell I can do this (with no password prompts!) and then I am logged in as bob and I can do anything. However, I need to do this non-interactively, in a script. Something like sudo su - bob && whoami.

But I could not come up with any other way to gain bob's power:

E.g. sudo su -c whoami bob results in [sudo] password for alice: and then Sorry, user alice is not allowed to execute '/bin/bash' as bob on lovelyplace.

I tried many combinations of su, sudo, etc., but the result is always the same - password prompt and after that, rejection.

I need to come up with the way to programmaticaly log in to the server as alice and then execute stuff as bob. I need a non-interactive one liner similar to sudo whoami, which would print out bob. Otherwise I am not able to deploy my app by script.

Any suggestions how to mimic this strange sudo su - bob in script?

UPDATE: bob does not have the same powers as root. He can't read sudoers, etc., so he has more privileges than alice, but apparently not that much to adjust root settings.

share|improve this question
    
sudo su -c whoami bob should work. Are you sure this message isn't from sudo -u bob whoami? –  Gilles Jul 14 '13 at 20:09
    
Maybe the entry in the sudoers file is restricting you to only a specific command (su - bob). But since you can log in as bob, you can open /etc/sudoers (or a file in /etc/sudoers.d) and add the commands you need. –  Paulo Almeida Jul 14 '13 at 20:12
    
@Gilles, I just tried it out and it's "not allowed". @Paulo, I'll have to update the question, because thanks to your suggestion I found out bob in fact isn't root. I can't even cat sudoers file, so bob is apparently quite limited in it's powers. –  Honza Javorek Jul 14 '13 at 20:24
    
@HonzaJavorek What sudo permissions do you have, exactly? Only the permission to run the exact command sudo su - bob? If so, I agree that the server's setup is horrible! Do you then need to run commands as root? bob isn't root, only root is root. Do you mean that bob can use sudo to run commands as root? –  Gilles Jul 14 '13 at 20:31
4  
@HonzaJavorek, you can run sudo -l to know what you are allowed on the server. –  Paulo Almeida Jul 14 '13 at 20:37
show 5 more comments

2 Answers

You should be able to pass the commands to be run to stdin of the sudo su - bob command (and hence to the shell it creates):

sudo su - bob <<ENDCOMMANDS
echo "Running as:"
whoami
echo "done now...
ENDCOMMANDS
share|improve this answer
add comment

It would appear the privilege kung-fu on your server is a quite interesting piece of work. There are two things you can try, but as we can only guess what alice and bob may and may not do, YMMV.

Why does it have to be a script that is run as alice? Because it's some automated access? Well, if there is some cron daemon, you can have a cron job for bob which regularly executes some bash script. If that bash script is writable by alice you found yourself a method to execute scripts as bob without the need for su(do)? voodoo. Yet it does soften security a bit ...

Another approach, I have never tried, goes along the lines of a background shell with stdin and out tied to pipes. It should be possible to send sudo su - bob\n to the stdin pipe and it should make the background shell execute that command. Every subsequent command sent to the background shell should be executed as bob. A rough sketch is this:

mkdir -p /tmp/backshell
mkfifo /tmp/backshell/stdin
mkfifo /tmp/backshell/stdout
mkfifo /tmp/backshell/stderr

bash -l >/tmp/backshell/stdout 2>/tmp/backshell/stderr </tmp/backshell/stdin &

cat /tmp/backshell/stdout &
cat /tmp/backshell/stderr >&2 &

echo "sudo su - bob" >> /tmp/backshell/stdin
echo "whoami" >> /tmp/backshell/stdin

However, it has the flaw that after the first echo the stdin pipe is closed and consequently the backshell as well. So you must either find a way to keep the stdin pipe from being closed, or you implement it using something a little more sophisticated. I think python as a pretty good module for subshells and interacting with them.

share|improve this answer
    
Another possible hack is to set up a simple setuid script owned by bob. Again, this weakens security significantly. –  tripleee Jul 16 '13 at 6:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.