Tag Info

New answers tagged

1

Solution Create a new Group: groupadd -r updaters The -r option reserves a system group, i.e. 0 - 100. Add Users to Above Group: useradd -G updaters john, useradd -G updaters sally. You can also use the user alias section to acheive this. See Sudoer File Examples for a fully functioning User Alias Section. In my opinion, doing it the way I've done ...


-2

No. If logging is enabled for sudo, sudo -i FOO logs FOO (thus leaving an audit trace) while sudo su; FOO will only log the su but not the commands that follow it (like FOO). And of course the main difference is the use of passwords: sudo -i needs only the password of the user (if sudo is configured that way) while sudo su needs the password of root.


1

This is not a complete answer, but I wonder if you could accomplish this using SSSD. The pam_sss module lets you restrict a service to only considering particular domains in /etc/sssd/sssd.conf. From pam_sss(8): domains Allows the administrator to restrict the domains a particular PAM service is allowed to authenticate against. The format is a ...


4

That shell wrapper looks like an init script, but apparently it isn't (hence you need to use sudo there; scripts run by init would not require this). This seems to be a very clumsy way to do this; the shell wrapper does not serve any purpose that could not be better served by the python program itself. Get rid of that; if you want an init script ...


0

The fact that the login UID doesn't change after sudo or su is the whole point of a having login UID, separate from the real and effective UIDs. It's meant for logging purposes. Neither the login UID nor any other UID of a process has a direct impact on a process's limits or performance. Limits are set by the program that logs you in. After that, they are ...


4

chmod u+r doesn't do what you apparently think it does; what it actually does is make the file readable by its owner. Which, I'm going to guess, it already was. chmod o+r (make file readable by "others", i.e., not owner/group) would probably work, but security argues against this. Pick one: ls -l /var/log/apache2/error.log ... on my (Debian) system, its ...


2

Run sudo visudo and add this line: Defaults timestamp_timeout=-1 -1 = never timeout the password Also see man 5 sudoers Though the above solution attracts security concerns. Please follow this link to set up sudo to run without password for specific commands.


4

I can think of many solutions for this specific problem : (A) Configure sudo access such that your username does not require password for tail command (or for all commands, if you so require) Refer sudo and sudoers Documentation for this. (B) Configure sudo access with negative timeout. Default timeout is 5 minutes , after that you will have to reenter the ...


0

Yes. man su | sed '/^FILES/,/^$/!d' FILES /etc/pam.d/su default PAM configuration file /etc/pam.d/su-l PAM configuration file if --login is specified /etc/default/su command specific logindef config file /etc/login.defs global logindef config file There's no sudoers there. Maybe these files have been configured in a ...


8

To answer your question directly: no, there is no good reason to do this. Also, sudo su produces two log entries when one would suffice. I've seen many people do this, and when I ask why they don't just run sudo -s, the answer is just that they don't know about the -s flag to sudo, and generally they switch after I point it out. However, to your list of ...


25

As you stated in your question, the main difference is the environment. sudo su - vs. sudo -i In case of sudo su - it is a login shell, so /etc/profile, .profile and .bashrc are executed and you will find yourself in root's home directory with root's environment. sudo -i is nearly the same as sudo su - The -i (simulate initial login) option runs the shell ...


7

Since the sudoers file permits the specifying of hostnames in the rules, sudo needs to know what the name of your Ubuntu machine is. Because of this, sudo collects a list of all interfaces on your Ubuntu machine (loopback and "real"). See relevant section from sudo source code for interfaces.c, at the link below. ...


0

This is much easier than suggested by other answers. No need to format, reboot or use live CD. su root # then enter your password to switch to root user chown root:root /usr/bin/sudo && chmod 4755 /usr/bin/sudo exit # to get back to the original user This is the easiest way to fix this issue. Explanation, sudo is corrupted (I know corrupted is the ...


0

For future reference: To suppress dd output completely redirect stderr to /dev/null like so: dd if=/dev/urandom of=sample.txt bs=5MB count=1 2> /dev/null This works nicely if you want to, for example, time the process using the time command in bash and assign the result to a variable, without getting any of the output that dd produces. reference: ...


1

The Bourne shell has a -c flag which you can use to pass an arbitrary script to the shell, so that you can write something like sudo sh -c 'something' This is however only useful for the simplest commands, because it is very cumbersome to quote the script correctly and the inconvenience is even higher if you send the command to a remote server over ssh ...


1

Another way would be to pass a full bash command(s) to sudo: #!/bin/bash sudo bash -c 'command1; command2; command3;' However, a better way would be to launch the script with sudo instead. It is not a very good idea to have sudo inside the script. Far better to run the entire script with root privileges (sudo script.sh). If necessary, you can use sudo to ...


7

The problem is sudo -s without any argument will open an interactive shell for root. If you just want to run a single command using sudo -s, you can simple do: sudo -s command For example : $ sudo -s whoami root Or you can use here strings : $ sudo -s <<<'whoami' root If you have multiple commands you can use here doc : $ sudo -s ...


0

You need to add the command ahead of sudo -s, instead of in the next line. sudo -s something...


1

Pipe the password into the su, which in turn is piped to ssh. Example below. Note how foopass is the correct password for user foo, so it runs the id command happily. Note how badpass is the wrong password for user foo, so it generates Authentication failure. $ echo "echo foopass | su foo -c id" | ssh -t -o RequestTTY=yes steve@localhost Pseudo-terminal ...


0

After much struggle I realized the problem was switching to root (su root) with the password supplied during the initial configuration. I was then able to run chromeos-setdevpasswd with elevated privileges to change the default chronos password. I took detailed notes here.


0

I personally needed to gather a number of files I could only read with sudo and I wanted to do it in one go. ssh user@remote 'cd /path/to; sudo tar zcvf - files*' > files.tar.gz From there you just have to tar xf the file and get all of the files you want.


4

sudo su asks for the user's password, the user has to be in the sudo/adm/admin/wheel group (depening on flavour of the OS) to be able to execute sudo. The root password will be prompted when using su alone. Check the settings in /etc/sudoers file to see why you are not being asked for a password while using sudo. Most likely the time-out is set to a few ...


1

This is a Catch 22 you're in. You're trying to install something python-related that was made for Python v2, not 3, but the default version used and installed on your system IS v3. The module mentioned is now called configparser in Python 3, whilst it was called ConfigParser in Python 2. As we're on an OS where case sensitivity is very important, the ...


7

There is a timestamp_timeout option in your /etc/sudoers... Example: to get password remembered for 5 hours Defaults timestamp_timeout=300


18

There is timestamp_timeout option in your /etc/sudoers. You can set up this option to number of minutes. After that time it will ask for password again. More info in man sudoers. And make sure you edit your sudoers file using visudo, which checks your syntax and which will not leave you with wrong configuration and inaccessible sudo.


1

So, finally I got the answer to your problem. Your ECHO environment variable consists of /usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/local/bin:/opt/aws/bin:/root/bin. But, it doesn't contain /usr/bin. When I do which yum OR which sudo in my CentOS, the output I get is that these executables are located in /usr/bin. So, the only way I think it'd work is ...


6

To be honest, if you're going to allow users to run everything except a few commands, you're going to run into problems. For example, you're disallowing access to the user* commands yet users can still run vipw or even just edit the password and shadow files using a text editor. And if you lock down access to vi for example, what's do prevent them ...


1

Don't take ownership of /usr/local. Use sudo to install software. But use your own account to build it. git clone … # or tar -x or … cd … ./configure make sudo make install Why not take ownership of /usr/local? You nailed it. That would allow any program running on your account to write there. Against a malicious program, you've lost anyway — infecting ...


0

Run sudo visudo or alternatively open /etc/sudoers Check for the line secure_paths="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", If your Java is located somewhere else add that path to this list.


1

Browsing as guest, open Crosh (ctrl+alt+t) and run shell Does that work? Can you log in as 'chronos' without a password? Alternatively open VT2 shell (ctrl+alt+F2) Can you log in as 'chronos' in VT2 without password? If so, you should be able to use 'sudo' without a password in that environment. Have you setup any Google accounts and ...


0

Most build systems honor --prefix=$path where /usr/local is usually the default. So normally you build + test + install, where the build + test step can occur anywhere you have write permission + the install step is usually... sudo make install (installs into --prefix) One way to setup your build environment is to have a build directory with a work + ...


1

Approaches There are 2 approaches to this solution. /usr/local/{src,bin} is for custom built software installed by the System Admin, ie, root, in which case sudo or su - should always be used, making this question a moot point. Install pre-compiled binary updates, i.e those found in your distributions package management mechanism, but unsupported versions ...


2

There are two common ways to execute commands as the administrator: with su or with sudo. The su command requires the root password, and can be used by any user who knows the root password. The sudo command asks for your own password, and can only be used by users who have been authorized by the administrator. (Both commands can be configured differently, ...


3

Sudo and the /etc/sudoers file aren't just for granting users full root access. You can edit the sudoers file with an existing sudo user, with the command sudo visudo You can group the commands that you want to grant access to like below: Cmnd_Alias SHUTDOWN_CMDS = /sbin/poweroff, /sbin/halt, /sbin/reboot Cmnd_Alias UPDATE_COMMANDS = /usr/bin/apt-get ...


0

Or simply add ravenous to the sudo group. Login as root or use su. Then to add the user to the sudo group use this: usermod -aG sudo ravenous A default install of the sudo package on most Linux systems already have the group sudo setup for access (I know debian does as thats what I use myself), so simply adding any username to that group will grant access ...


1

Log into root with the su command. check your users groups with the command "groups ravenous" (note groups) edit /etc/sudoers with, for example nano or vi "vi /etc/sudoers" scroll down to the part where you see groups that are uncommented (no # in front) and see if you are in that group (which your obviously are not) if any group is allowed you need to add ...


4

Add an entry into /etc/sudoers to permit user ravenous to run dpkg as root. See man page for sudo for more detail.


1

Try this command to su a command as different user. su user -c command could someone suggest how to run it with PATH exported?


3

You're executing the command sudo su - USER2; whoami; pwd on the remote host. Let's decompose that: Commands separated by a semicolon are executed in sequence. Thus the command sudo su - USER2 is executed first; then, when it finishes, whoami is executed, and finally pwd is executed. The command sudo su - USER2 starts a login shell as user USER2. This ...


2

You can configure mc to run an external editor, then start it like this: EDITOR=sudoedit SUDO_EDITOR=vim mc ($SUDO_EDITOR should point to your favourite editor). Then mc will run sudoedit when you press F4 to edit files.


1

As openvpn needs root privileges to set routes or ip addresses for an interface it is very uncommon to run it as a user, if possible at all. But the command not found is a simple PATH topic. Check sudo which openvpn where root calls the binary. Normally openvpn lives in /usr/sbin, a location for daemon programs, that are started as root and possible ...


0

If you can't edit /etc/sudoers file. follow this. it worked for me. cd /etc sudo su visudo -f sudoers


0

You don't those /dev links to do this. I know sudo will purge environment variables, but you can still pass variables through in the form of arguments since you're calling another shell anyway... sudo -u nobody bash -c ' a=$1; echo "$a" ' -- "$(echo aaa)" ...or... echo aaa | { sudo -u nobody bash -c ' a=$1; echo "$a" ' -- ...


0

First, my suggested solution is presented below. After this, each of the two errors that you observed are discussed. Suggested Solution Bash variables cannot hold a NUL character. Consequently, it is only possible to read an entire file into a bash variable if the file contains no such characters. Subject to this bash limitation, the following should ...


0

There's actually a fairly simple way to do this, by creating a Bash (or shell of your choice) script to restrict the modifications made to a particular file or directory. In your example, it would look like this: $ vi /usr/local/bin/mychmod #!/bin/bash chmod 777 /var/www/index.html Then you would change the sudoers file to allow www-data to execute ...



Top 50 recent answers are included