8

I have an /etc/sudoers with the following:

glens   ALL=NOPASSWD:/usr/sbin/service php5-fpm
glens   ALL=(ALL:ALL) ALL

And I'm trying to run the command:

sudo /usr/sbin/service php5-fpm restart

However, I'm still prompted for my password.

This AskUbuntu question/answer suggests I have the correct syntax, but I'm still prompted.

13

The NOPASSWD entry should be placed beneath the other line:

glens   ALL=(ALL:ALL) ALL    
glens   ALL=NOPASSWD:/usr/sbin/service php5-fpm

From the manual (man sudoers):

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

Therefore your order of NOPASSWD being first will be overridden by the second line (ALL=(ALL:ALL) ALL).

  • I see in the manpage that this is true, changing the order doesn't seem to have any effect on being prompted for a password. – Glen Solsberry Nov 30 '15 at 15:47
  • 3
    You need a * at the end of the nopasswd sudoers entry to allow sudo to match 'restart' – Jeff Schaller Nov 30 '15 at 18:37
  • 1
    Or the full command glens ALL=NOPASSWD:/usr/sbin/service php5-fpm restart – Yu Jiaao Jun 14 '17 at 4:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.