Hot answers tagged

8

I'm going to say this is not possible because vim is not executing remote commands. It is simply using scp to copy the file over, edit it locally and scp it back when done. As stated in this question sudo via scp is not possible and it is recommended that you either modify permissions to accomplish what you're wanting or just ssh across to the remote machine....


7

cd is a shell builtin, and sudo only works with programs. Try using either su - or sudo -i before changing directory. These will elevate your login session to that of the root user. Once finished making changes, make sure to type exit to return to being a normal user.


6

What is the error I get with login? When searching trough the source code of login, we see this passage: amroot = (getuid () == 0); [...] utent = get_current_utmp (); /* * Be picky if run by normal users (possible if installed setuid * root), but not if run by root. This way it still allows logins * even if your getty is broken, or if something ...


6

Sudoers wildcards are only supported with globbing (man glob, man fnmatch). Yet, the start, stop, restart (, etc.) commands for systemctl cannot be globbed since they are not files. The fact that you need to enumerate every command is a good thing from a security standpoint. If dhcpcd@eth0.service is updated with a command, say shutdown-machine on a ...


4

I'd amend your list of criteria for protecting a script a little. Given this - or a similar - entry in /etc/sudoers: www-data ALL=(ALL) NOPASSWD: /usr/local/sbin/mycommand we can state that the script: must be writeable only by the root user must be readable and executable by the root user must be in a hierarchy of directories that can only be written ...


4

Named pipe approach. As root, run mkfifo -m 666 /tmp/foo /tmp/readpipe.sh & And can, as user www-data then write to the pipe echo test >>/tmp/foo readpipe.sh in its simplest form (perl with taint would be better) : #!/bin/sh while read A </tmp/foo do echo received $A done


4

The command is sudo. Add a line such as below into /etc/sudoers sigis ALL=(ALL) NOPASSWD: ALL This means user sigis can now run things like the command below without requiring password. sudo shutdown -h now


4

sudo by default uses a minimal PATH, to make it safe for use by the root user. That is not necessarily the same as the PATH you would get by logging in as the root user, or by doing sudo su - For instance, in newer Red Hat releases, I've noticed that the path omits /usr/local/bin. The manual page summarizes this in a section entitled Security Notes: ...


4

Like the accepted answer, I don't think this is possible directly. However, I see at least two ways to still accomplish your goal. Running vim remotely ssh user@myserver sudo vim /some/file This has disadvantages: Your interactions with vim go over the network. Significant lag will be annoying, and if your connection dies, so does vim (eventually). ...


3

Things that can affect the setuid program Let's consider some ways the calling user could affect the behavior of the setuid process. I'll divide the things to consider in three groups: 1) the program itself, 2) the input to the program, and 3) the environment it runs in. The binary: If the unprivileged user can modify the binary that will be run, that ...


3

You can use the -c option of su to pass a single command. su root -c 'sh /home/jay/script-that-needs-executing-as-root.sh'


3

If you know the root password then you can do $ su root # rm /etc/sudoers.d/jupyter visudo will validate the sudo files if in edit mode; you ran it in export mode...


3

The directory is on an NFS-mounted filesystem. Likely, the NFS server has exported it with the root_squash option (default on most systems), meaning that for access to this filesystem, the root user is mapped to the nobody user, and is thus subject to the permissions for 'others' for the directory. Possible actions: Don't use root for accessing this ...


2

Just figured out the problem. When you giving privileges from other then the root user, then you need to specify user at the sudo command. See below example: This command run by cat and it works. sudo -u dog vim /home/dog/test.txt


2

To resolve the error message, you may need to install sudo using the steps below. Alternatively, you could run the command after logging in with the root account using su -. To install sudo: Log in with the root account using su -. Then, yum install sudo. After that is installed, add the user's account to the /etc/sudoers file. After the following ...


2

The best thing to do is never use pip outside of a virtualenv, so there is never a need to sudo pip, ever. For you system installs of python packages the dependencies within the package manager should take care. Use separate virtualenvs for each of your python utilities/programs. This allows you to run appropriate python versions and prevents you from '...


2

You would need the root password or have your public ssh key in ~root/.ssh/authorized_keys. Once you had that, you could probably do vim scp://root@nagios//tmp/notouch Bottom line: this is effectively just a shortcut for scp root@nagios:/tmp/notouch /tmp/notouch vim /tmp/notouch scp /tmp/notouch root@nagios:/tmp/notouch If you have the necessary access ...


2

As root edit /etc/sudoers and place the following line: youruser ALL=(ALL) NOPASSWD:ALL after # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL In this way you will be capable to execute all commands that require sudo privileges passwordless. In order to use sudo and be prompted for a password you need to remove ...


2

You take that comment out of context. This line is useful when building ports: permit nopass keepenv root as root Building ports always calls doas. Without the line above, this would restrict environment variables even when building ports as root. With said line building ports as root is done with the full environment.


2

Two lines should be enough for raspberrian (doc), assuming you are using the version based on debian wheezy (check with lsb_release -a): deb http://archive.raspbian.org/raspbian wheezy main contrib non-free deb-src http://archive.raspbian.org/raspbian wheezy main contrib non-free "after changing sources.list don't forget to sudo apt-get update" (thanks ...


2

One of the best thing is to use the "Digest_Spec" possibility in the sudoers file, to validate the checksum of your executable Extract of the man page: If a command name is prefixed with a Digest_Spec, the command will only match successfully if it can be verified using the specified SHA-2 digest. Using openssl, to generate the checksum: $ openssl ...


1

have you tried sudo ? if sudo -u sysadmin /bin/ping -c ... you must edit /etc/sudoers as root with %g1 ALL=(sysadmin) NOPASSWD: /bin/ping to allow people group group g1 to run ping command. see man sudo, man sudoers and http://askubuntu.com/questions/192050/how-to-run-sudo-command-with-no-password for details.


1

Answering the second part of the question, how to write messages while waiting at the sudo prompt: trap '2>/dev/null' CHLD (sleep 5; echo; echo "New spam has just arrived!") & MSGPID=$! sudo -v wait $MSGPID trap - CHLD sleep 5 in the subshell simulates the message arriving asynchronously. The first echo just makes sure the message doesn't end up ...


1

No one has a ✓ yet, so I put together an answer that has everything I could think of. 1 When you run an executable, sometimes the OS will deny your permission to. For example running make install with the prefix being a system path will need sudo, while with the prefix being a non-system path will not be asked for sudo. How does the OS decide that running ...



Only top voted, non community-wiki answers of a minimum length are eligible