I'm developing an application that will run on an Amazon EC2 instance, and execute certain commands that require root access. The problem is that different VM's give root access in different ways. E.g. some VM's give direct access to the root account, while others will simply allow a default non-root user access to sudo.

Now, I can easily solve the above example by adding an option to prepend "sudo " to all commands. However, I'm not very familiar with unix, and I'd like to know if there are any other ways of gaining root privileges that I should prepare my program for. Are su and sudo reasonably enough?

  • 1
    belongs to ServerFault or to Linux&Unix SE site
    – genesis
    Jul 11, 2011 at 18:02

3 Answers 3


There are several sudo-like tools (calife, op, super, …) — see How do I run a command as the system administrator (root) — but you could spend your life on unix systems without encountering them (they've all been displaced by sudo). In practice, if you need to call scripts as root, either arrange for all your machines to have passwordless sudo, or to allow ssh logins as root. There's not much of a security difference between the two: either way, the script must have all the credentials necessary to reach the root account.

If you only want your scripts to be able to execute specific commands, use specific entries for these commands in /etc/sudoers, or specific keys with a command= line in ~root/.ssh/authorized_keys.

  • POSIX file systems generally implement the setuid/setgid bits. This is never recommended because it can hardly be made secure, but it does work:


  cp /usr/bin/id /tmp/rootid
  sudo chown root /tmp/rootid
  sudo chmod u+s /tmp/rootid

watch closely for the euid field

  • sudo and su work; beware of sudo -E, or su - interactions with environments. Perhaps it is best to explicitely wrap all your su calls iwth env -i to be isolated from harm

  • Solaris has RBAC allthough OpenSolaris used to have a sudo package for compatibility

  • As I recall, setuid root works only for binaries, not for shell scripts. Is that right? Jul 11, 2011 at 21:05
  • Be aware, though, that at least on Linux (not sure about other *nixes), a file system may be mounted nosuid which will make the setuid bit have no effect.
    – user
    Jul 11, 2011 at 21:06
  • 1

If you are attempting to run a command from a script, pass the -t option to ssh:

ssh -i file.pem -t myhost “sudo -n myscript”

The -n option to sudo will prevent sudo from prompting for a password; if the command requires a password you’ll get an error.

It worked for accessing EC2 instances.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .