8

I am trying to use the sudo command and sudoers file correctly so that I can run a command as another user.

I have my sudoers file set up as follows:

beans ALL = (root,apache) NOPASSWD: /opt/renovations/var/script-*.sh

root, apache, and beans are part of the group beans.
Also /opt has 755 permissions, while the /opt/renovations directory and it's sub-directories are owned by the beans user and group.

The command I'm trying to run as beans is:

sudo -n -u apache -i /opt/renovations/var/script-test.sh  

-n: is so that I'm not prompted for a password, as this will be run by a cron
-u: is so that I can impersonate the apache user
-i: is so that I simulate a login, and my .profile is loaded. I need this so that I access the environment variables in .profile.

The problem is that when I run the sudo command, I get the following message:

sudo: sorry, a password is required to run sudo

I've tried running this both on AIX and Ubuntu, but the problem is on both systems. This works if I run:

sudo -n -u apache /opt/renovations/var/script-test.sh

But without the -i, my environment does not contain all of the environment variables that I need to be there.

Is there something I need to update in my sudoers file so that this is possible?

  • What does visudo -c return (checks sudoers for errors). Also, can you confirm the full version of AIX (oslevel -s) and the version of sudo installed? – EightBitTony Aug 1 '14 at 12:13
  • 1
    Also, does it work if you list the script name explicitly in sudo rather than the wildcard (and is the filename a symbolic link?). – EightBitTony Aug 1 '14 at 12:18
  • Thanks @EightBitTone. So I found solution for this sudoers configuration issue: when -i switch is in use then real command is beans ALL = (root,apache) NOPASSWD: /usr/bin/ksh -c /opt/renovations/var/script-*.sh and beans ALL = (root,apache) NOPASSWD: /usr/bin/bash -c /opt/renovations/var/script-*.sh But now I get the new error, for example: ksh: /opt/renovations/var/script-test.sh: cannot execute – krzyszto Aug 1 '14 at 14:02
  • Analysing the /var/log/sudolog log file was very helpful to debug above issue (on AIX). – krzyszto Aug 1 '14 at 14:42
4

So as you said yourself @krzysto, the solution is to add the following to the sudoers file

beans ALL = (root,apache) NOPASSWD: /usr/bin/ksh -c /opt/renovations/var/script-*.sh 
beans ALL = (root,apache) NOPASSWD: /usr/bin/bash -c /opt/renovations/var/script-*.sh

The next piece that is missing is to make sure that the group has execute permissions on the scripts, so that you can execute them.

  • yes, it is correct solution. The ksh error happens only on testing environment created for investigating the impersonation issue; in real, production all works correctly – krzyszto Aug 1 '14 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.