Ways to execute shell command as root?

Question

I'm developing an application that will run on an Amazon EC2 instance, and execute certain commands that require root access. The problem is that different VM's give root access in different ways. E.g. some VM's give direct access to the root account, while others will simply allow a default non-root user access to sudo.

Now, I can easily solve the above example by adding an option to prepend "sudo " to all commands. However, I'm not very familiar with unix, and I'd like to know if there are any other ways of gaining root privileges that I should prepare my program for. Are su and sudo reasonably enough?

Answer 1

There are several sudo-like tools (calife, op, super, …) — see How do I run a command as the system administrator (root) — but you could spend your life on unix systems without encountering them (they've all been displaced by sudo). In practice, if you need to call scripts as root, either arrange for all your machines to have passwordless sudo, or to allow ssh logins as root. There's not much of a security difference between the two: either way, the script must have all the credentials necessary to reach the root account.

If you only want your scripts to be able to execute specific commands, use specific entries for these commands in /etc/sudoers, or specific keys with a command= line in ~root/.ssh/authorized_keys.

Answer 2

• POSIX file systems generally implement the setuid/setgid bits. This is never recommended because it can hardly be made secure, but it does work:

.

  cp /usr/bin/id /tmp/rootid
  sudo chown root /tmp/rootid
  sudo chmod u+s /tmp/rootid
  /tmp/rootid

watch closely for the euid field

• sudo and su work; beware of sudo -E, or su - interactions with environments. Perhaps it is best to explicitely wrap all your su calls iwth env -i to be isolated from harm

• Solaris has RBAC allthough OpenSolaris used to have a sudo package for compatibility

Answer 3

If you are attempting to run a command from a script, pass the -t option to ssh:

ssh -i file.pem -t myhost “sudo -n myscript”

The -n option to sudo will prevent sudo from prompting for a password; if the command requires a password you’ll get an error.

It worked for accessing EC2 instances.