I'm running a shell script using terminal from userA
. In the middle of this shell script, I switch to userB
user using su
, but this asks me for the password of userB
and I have to manually enter the password through terminal. I'm asking if there is a way so that I can enter the password automatically without having me to stay beside the machine to manually enter the password? As there is a loop in this script and I don't want to keep staying all the time looking at the terminal to enter the password of userB
when it asks me. Or if there is a way I can put the password in my shellscript so that the terminal won't wait for me to manually enter it? Could anyone please advise how this could be done?
3 Answers
sudo
also allows NOPASSWD
on specific entries in the /etc/sudoers configuration, if you can get to that. Like:
userA ALL = (userB) NOPASSWD: ALL
This will give userA full access to userB without password. Should probably only be used if userA can be trusted to lock his screen whenever leaving it …
Alternatively, you can give userA access to only certain scripts. For instance:
userA ALL = (userB) NOPASSWD: /home/userB/scripts-for-userA/
This lets userA run any command in the directory /home/userB/scripts-for-userA/ as userB. It's still only as secure as those commands are, though.
-
1NOPASSWD: option can be skip, in which case userA's password will be asked once, and from time to time.– ArchemarMar 15, 2015 at 10:06
sudo
will cache the password. But you rely need to ask if you are doing this right. Would it be better to change the permissions, so that you and userB have access to the same files?
-
Thanks for your answer. Actually I can't change the permissions, I need to run su through the shell script. I think even sudo will ask me for the password because I will switch between the two users many times.– TakMar 15, 2015 at 9:41
You could move the stuff that's supposed to happen as UserB into a separate script that's suid to UserB. This will avoid the need to open up su to userB from userA if you don't want that blanket privilege.
-
anytime you are thinking about making a suid script read super's man page. so much less work, so much more secure.– hildredMar 15, 2015 at 21:10
-
@hildred mind adding a link to the man page, somewhere online? "man super" is not exactly something that gets useful search results– atkMar 15, 2015 at 21:37
-
-
@hildred thanks! I read much of the man page, and it seems like super is to replace suid root, but I don't see options for suid nonroot, which appears to be what the OP was looking for. Am I just overlooking something?– atkMar 15, 2015 at 22:04
-
yes, and you can even have per user super tab files under individual user control. They are introduced as the second section. For entries in the main super.tab, group 5 options cover setting uid and such.– hildredMar 15, 2015 at 22:23
ssh -i privkey userB@localhost
where privkey is a password protected key. Else you can usesudo
, which will ask you passwd less often.