Can sudo to user but 'run command as' is denied?

Question

I was wondering how to run a command as another user from a script without password. sudo -l return: (root) NOPASSWD: /bin/su - someuser

There is no problem to sudo as someuser. Command sudo su - someuser works without password. But every time I try to execute command as this user I'm prompted for password. I tried both: sudo su -c pwd someuser sudo -u someuser pwd

Are there any alternatives? What is the cause of the problem? I don't have root access.

Answer 1

I might be stating the obvious, but I think the answer is in the config.

You've mentioned your config shows

 (root) NOPASSWD: /bin/su - someuser

So you are permissioned to run only one command ie /bin/su - someuser as root (so this avoids su prompting for a password) and the NOPASSWD: means sudo will not ask you for a password to do it.

But you want to run other commands as someuser, (directly from your own shell) sudo -u someuser somescript But that's not configured.

You want, sudo -l to show something along the lines of

(root) NOPASSWD: /bin/su - someuser
(someuser) NOPASSWD: /bin/ls, /usr/bin/whoami, /home/someuser/bin/ascript

(above output may not be 100% as it will be displayed but hope you can understand what I mean)

The way you are configured at the moment, means you must first su to someuser and then run commands as that user.

It sounds like you don't have admin control over this machine. Maybe develop the script as the someuser, then you'll have a list of commands and a script tested, to got back to your admin, to add to /etc/sudoers.

Answer 2

it's possible to remove sudo password prompt for non-root users by adding (or uncommenting existing) line in /etc/sudoers file

it's also possible to create separate files for users in /etc/sudoers.d/ directory

---

adding passwordless sudo users:

someuser ALL=(ALL) NOPASSWD: ALL

the same thing for groups:

%somegroup ALL=(ALL) NOPASSWD: ALL

these lines can be added (appended) to /etc/sudoers file, or to separate ascii (text) files in /etc/suedoers.d/ directory

Answer 3

If command sudo su - someuser works without password then you should be able to do this:

sudo -u someuser command

If that does not work, then it is probably set to only allow su command without a password. Thus, try this:

sudo su -c "COMMAND1; COMMAND2" -m "USER"

e.g.

sudo su -c "cd /home/user ; mkdir testdir" -m "user" 

Answer 4

This works for me.

sudo su - user <<< "command"