13

When I'm trying to execute ls as user abc with the following command I get an error:

xyz@host:~/temp$ sudo -u abc ls
[sudo] password for xyz:
Sorry, user xyz is not allowed to execute '/bin/ls' as abc on host.

But if I do su abc and then execute ls I have no problem

18

You should configure sudo security policy to allow user xyz exec something as user abc. Read 'man sudoers' and use visudo command to configure /etc/sudoers.

For example let's allow user xyz exec /usr/bin/whoami as user abc without password. Add this string into /etc/sudoers (with visudo, don't edit /etc/sudoers directly):

xyz ALL = (abc) NOPASSWD: /usr/bin/whoami

And now test it:

xyz@host:~$ sudo -u abc /usr/bin/whoami
abc
| improve this answer | |
  • did you mind explain why should avoid edit /etc/sudoers directly? – Adi Prasetyo Nov 20 '19 at 11:08
  • Because when you edit /etc/sudoers directly you can make a mistake, broke the sudoers file and (in worst scenario) block yourself with using sudo. 'Visudo' is not just an editor, it also checks the syntax of the sudoers file and helps to avoid mistakes, typos etc. – svq Nov 20 '19 at 11:15
4

This is because sudo is different from su. When you su abc, you become the user abc as far as the system is concerned. You can then do anything that abc can do.

On the other hand, sudo is used to allow other users to execute some commands by proxy. In other words, your sudo configuration allows you to do some commands on behalf of abc. If the command you're trying to execute is not one of them, you get the error you reported.

| improve this answer | |
0

In case everything is looking alright, but you still get Sorry user xxx cannot execute... message and it keeps asking you for a sudo password everytime.

You can do this:

  1. In /etc/sudoers delete line with your user settings
  2. Save file
  3. Open file, type (NO COPING) your options for that user
  4. Save file
  5. Try it.

This worked for me. It turned out that the ending in that line was bad because I copied commands that needed execution from email.

| improve this answer | |
  • Surely if you had used visudo to edit it in the first place, you'd have been told that? – Auspex Nov 14 '16 at 10:36
  • Nop, you wouldn't. – borbar Nov 14 '16 at 11:18
  • Ah, well. I really would have thought... In any case, I think you are far more likely to get errors manually typing than from copy and paste. Just be aware that line-ends differ. – Auspex Nov 15 '16 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.