0

I have visudo-edited /etc/sudoers this way:

User_Alias  APACHE = www-data
Cmnd_Alias  FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route

APACHE  ALL = (ALL) NOPASSWD: FIREWALL

(To allow php running iptables cmd).

Is there a way to achieve the same, purely with terminal/tty/cmdline AND/OR root shell script ?

1

Sure. You can just drop files into /etc/sudoers.d instead of editing the sudoers file itself:

cat > /etc/sudoers.d/apache <<EOF
User_Alias  APACHE = www-data
Cmnd_Alias  FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route

APACHE  ALL = (ALL) NOPASSWD: FIREWALL
EOF
chmod 440 /etc/sudoers.d/apache

And I guess if you were stuck with a really old sudo without support for the sudoers.d directory you could just concatenate that to /etc/sudoers:

if ! grep -q APACHE /etc/sudoers; then
cat >> /etc/sudoers <<EOF
User_Alias  APACHE = www-data
Cmnd_Alias  FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route

APACHE  ALL = (ALL) NOPASSWD: FIREWALL
EOF
fi

(The if ! grep -q ... is there to prevent concatenating this multiple times if the script is run more than once)

0

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .