Hot answers tagged

15

The purpose is to prevent ordinary users from running the su command (su is similar to sudo, the difference being that sudo executes one command, su starts a new session as a new user, which lasts until that user runs exit) The default mode of su is 4755 or rwsr-xr-x, the "s" means that the command is set-UID (which means that it always runs as the user who ...


7

I'm going to say this is not possible because vim is not executing remote commands. It is simply using scp to copy the file over, edit it locally and scp it back when done. As stated in this question sudo via scp is not possible and it is recommended that you either modify permissions to accomplish what you're wanting or just ssh across to the remote machine....


6

As you determined, sudo is set up to only allow sudo su - kshitiz, so your second command is bound to fail. In any case, you're not going through the same user transitions. sudo su - kshitiz runs su - kshitiz as root; if you can sudo to root with no password, this will not ask for a password at all since su - as root changes users without asking for a ...


4

Like @Serge pointed out in a comment, this line debug1: Offering RSA public key: /root/.ssh/id_rsa in your ssh -v output tells you that ssh tried to authenticate with the public key in root's home directory (/root) and not your own user directory (/home/yourusername). This leaves you with three options. You can either run ssh with the -i option to ...


4

Package managers need to run as root because what they do affects all users. IMO package managers should require sudo only when writing files to a dir owned by root. like /bin or /etc. They also require root access to manage the database of installed packages. A package manager that installs software under a user's home directory doesn't need to run ...


4

Like the accepted answer, I don't think this is possible directly. However, I see at least two ways to still accomplish your goal. Running vim remotely ssh user@myserver sudo vim /some/file This has disadvantages: Your interactions with vim go over the network. Significant lag will be annoying, and if your connection dies, so does vim (eventually). ...


3

If you know the root password then you can do $ su root # rm /etc/sudoers.d/jupyter visudo will validate the sudo files if in edit mode; you ran it in export mode...


3

The directory is on an NFS-mounted filesystem. Likely, the NFS server has exported it with the root_squash option (default on most systems), meaning that for access to this filesystem, the root user is mapped to the nobody user, and is thus subject to the permissions for 'others' for the directory. Possible actions: Don't use root for accessing this ...


3

Depending on your users, that may be a good or bad idea. The su command can be used by ordinary users to log into any other account, not just the superuser's, provided they know the password of the account. This is useful e.g. when two users are cooperating on a project, one of them (userA) is logged in and they need to read a file only accessible to the ...


3

Configuration is OK, but you need to have some identities in your ssh-agent to be able to authorize the sudo operation. You can verify that your agent has some identities using ssh-add -L It should print the public keys in your agent and at least one of them should match the public key on server in /etc/security/authorized_keys. If the agent does not ...


3

This is wrong syntax in bash: nohup ./NEW_SCRIPT_NAME.sh & && rm NEW_SCRIPT_NAME.sh From Shellcheck: Line 1: nohup ./NEW_SCRIPT_NAME.sh & && rm NEW_SCRIPT_NAME.sh ^-- SC1070: Parsing stopped here. Mismatched keywords or invalid parentheses? You can not simply run something & && something, ...


3

The -s switch for su command is to change the shell of the specified user. The command you want to run must be preceded by -c switch. So the command you are looking for is something like this: su -s /bin/bash -c "$CATALINA_HOME/bin/catalina.sh run" tomcat


3

If you're running su as root, you can use -s to specify a different shell (running as root is necessary here since your tomcat user doesn't have a valid shell), and -c to specify the command to run: su -s /bin/sh -c "$CATALINA_HOME/bin/catalina.sh run" tomcat You might find start-stop-daemon useful; it has a whole slew of options to specify the user and ...


2

You need to watch out for the following two points: sudo gives the highest priority to the last matching configuration-line you need to separate different commands by ',' so your configuration-line has to be %sudo ALL= NOPASSWD: /usr/bin/pm-suspend, /usr/bin/gnome-session-quit


2

The problem is that you have a sudo configuration which allows running a login shell, but not directly running an arbitrary program. If the user has a restricted account, i.e. if the user's login shell is a program that only performs a few specific commands, then this is a security restriction; allowing you to run bash would bypass that security restriction....


2

To resolve the error message, you may need to install sudo using the steps below. Alternatively, you could run the command after logging in with the root account using su -. To install sudo: Log in with the root account using su -. Then, yum install sudo. After that is installed, add the user's account to the /etc/sudoers file. After the following ...


2

Executive summary: "root" is the actual name of the administrator account. "sudo" is a command which allows ordinary users to perform administrative tasks. "Sudo" is not a user. Long answer: "root" (aka "superuser") is the name of the system administrator account. The origins of the name are a little archaic, but that doesn't matter. Root user has user ...


2

To give Tim access to iptables, you can edit /etc/sudoers, with visudo: tim ALL=NOPASSWD: /sbin/iptables This will allow him to used the iptables as root without inputing his password. The path is full, for security reasons, otherwise if only iptables as you have, Tim would be able run any binary called iptables as root, and would be enough to create a ...


2

Let´s say you want to allow users bellonging to group users2 to do some privileged control over apache without giving them root privilege. Add to /etc/sudoers %users2 keep ALL=NOPASSWD: /sbin/service http,/etc/init.d/http,/usr/sbin/apache2ctl If you just want them to restart apache it will be: %users2 ALL=NOPASSWD: /sbin/service http restart,/etc/init.d/...


2

Just figured out the problem. When you giving privileges from other then the root user, then you need to specify user at the sudo command. See below example: This command run by cat and it works. sudo -u dog vim /home/dog/test.txt


2

You would need the root password or have your public ssh key in ~root/.ssh/authorized_keys. Once you had that, you could probably do vim scp://root@nagios//tmp/notouch Bottom line: this is effectively just a shortcut for scp root@nagios:/tmp/notouch /tmp/notouch vim /tmp/notouch scp /tmp/notouch root@nagios:/tmp/notouch If you have the necessary access ...


2

As root edit /etc/sudoers and place the following line: youruser ALL=(ALL) NOPASSWD:ALL after # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL In this way you will be capable to execute all commands that require sudo privileges passwordless. In order to use sudo and be prompted for a password you need to remove ...


1

Answering the second part of the question, how to write messages while waiting at the sudo prompt: trap '2>/dev/null' CHLD (sleep 5; echo; echo "New spam has just arrived!") & MSGPID=$! sudo -v wait $MSGPID trap - CHLD sleep 5 in the subshell simulates the message arriving asynchronously. The first echo just makes sure the message doesn't end up ...


1

On a hardened server, you want as few setuid/setgid binaries, especially such that can be run by a user account that does not need the particular tool, as possible - for one simple reason: You do not absolutely trust these tools to police what someone does with them. Bugs in such programs or their dependencies that allowed users to circumvent such policing ...


1

The simple but accurate explanation is that the vendors of iOS and Android don't want the end-user to have full control over the operating system, whereas the vendors of Unix systems do. It's a design decision by the device vendor. It is technically possible to have iOS or Android systems where the end-user has full control. There is no such iOS-based ...


1

The full strace in your pastebin link shows that sudo is trying to open libnss-sss.so.2: open("/lib64/libnss_sss.so.2", O_RDONLY|O_CLOEXEC) = 8 That's an NSS module for SSSD - System Security Services Daemon, which manages access to various remote authentication services. Check that the SSSD is installed and running. If it is, then try following the ...


1

Use a shell script instead of an alias. in ~/.bashrc: export PATH="$PATH":~/bin your script in ~/bin/runthat: #!/bin/bash sudo nohup /path/to/binary > /dev/null 2>&1 & Then to run it, just do it like: $ runthat Or if you skipped the PATH step, then run it like: $ ~/bin/runthat If this is a system-wide (all users) script instead of ...



Only top voted, non community-wiki answers of a minimum length are eligible