7

We have production centos servers that run apache as root to allow low port numbers (80 and 443).

We'd like a secure way for non-root users to restart apache.

Are there any security implications with adding something like this to the sudoers file...

username    ALL=NOPASSWD:/usr/bin/service apache2 reload

Specifically I'd like to know if there is any way for the user to then elevate their privileges, or somehow run other programs as root.

  • this might help you. – Rahul Jun 21 '16 at 4:34
  • link is already provided – Rahul Jun 21 '16 at 4:40
  • @Rahul This is useful. However it seems to be mostly discussing the implications of NOPASSWD sudo access generally. What I want to do is use it from a release script, where entering a password is impossible. The user already has ssh access to the machine, but doesn't have any sudo access currently. I'm just wondering if sudo access to a specific executable can be exploited to provide any higher level access. – user1751825 Jun 21 '16 at 4:49
  • AFAIK No it doesn't. – Rahul Jun 21 '16 at 5:00
12

Let´s say you want to allow users bellonging to the group users2 to do some privileged control over apache without giving them root privilege.

Add to /etc/sudoers

%users2 keep ALL=NOPASSWD: /sbin/service httpd,/etc/init.d/httpd,/usr/sbin/apache2ctl

If you just want them to restart apache it will be:

%users2 ALL=NOPASSWD: /sbin/service httpd restart,/etc/init.d/httpd restart,/usr/sbin/apache2ctl restart

The users will be able to see what commands they are allowed to use with sudo with:

sudo -l

And to restart Apache they have to spell out exactly the command as they are allowed to run it, for instance:

sudo /sbin/service httpd restart

It is advisable to define the full path of commands in the sudoers file, for security reasons.

  • 1
    This is tagged as 'centos' so the service name should be 'httpd' not 'apache2'. – jsbillings Jun 22 '16 at 0:42
  • 1
    Does the command need to match exactly? For example, is it able to recognize that "$ service http restart" is the same as "$ /sbin/service http restart"? More importantly, will it block sudo access to ~/bin/service, if that's in the users path? – user1751825 Jun 22 '16 at 5:41
  • It needs to match exactly, and it is better that way for security reasons. Otherwise your user could run a script with the same name to escalate to root, as you seem to have already figured out. If the user does not remember the correct path, teach them about sudo -L – Rui F Ribeiro Jun 22 '16 at 6:10
  • On Ubuntu, /sbin/service does not work but /etc/init.d/ works like a charm. – Josir Dec 17 '18 at 20:16
  • @Josir /etc/init.d or systemctl for systemd. Do not have my Debian at hand today, will confirm tomorrow. – Rui F Ribeiro Dec 17 '18 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.