0

I have visudo-edited /etc/sudoers this way:

User_Alias  APACHE = www-data
Cmnd_Alias  FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route

APACHE  ALL = (ALL) NOPASSWD: FIREWALL

(To allow php running iptables cmd).

Is there a way to achieve the same, purely with terminal/tty/cmdline AND/OR root shell script ?

1

Sure. You can just drop files into /etc/sudoers.d instead of editing the sudoers file itself:

cat > /etc/sudoers.d/apache <<EOF
User_Alias  APACHE = www-data
Cmnd_Alias  FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route

APACHE  ALL = (ALL) NOPASSWD: FIREWALL
EOF
chmod 440 /etc/sudoers.d/apache

And I guess if you were stuck with a really old sudo without support for the sudoers.d directory you could just concatenate that to /etc/sudoers:

if ! grep -q APACHE /etc/sudoers; then
cat >> /etc/sudoers <<EOF
User_Alias  APACHE = www-data
Cmnd_Alias  FIREWALL = /sbin/iptables, /sbin/ifconfig, /sbin/route

APACHE  ALL = (ALL) NOPASSWD: FIREWALL
EOF
fi

(The if ! grep -q ... is there to prevent concatenating this multiple times if the script is run more than once)

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.