using sudoers to allow non-privileged user to restart apache

Question

We have production centos servers that run apache as root to allow low port numbers (80 and 443).

We'd like a secure way for non-root users to restart apache.

Are there any security implications with adding something like this to the sudoers file...

username    ALL=NOPASSWD:/usr/bin/service apache2 reload

Specifically I'd like to know if there is any way for the user to then elevate their privileges, or somehow run other programs as root.

@Rahul This is useful. However it seems to be mostly discussing the implications of NOPASSWD sudo access generally. What I want to do is use it from a release script, where entering a password is impossible. The user already has ssh access to the machine, but doesn't have any sudo access currently. I'm just wondering if sudo access to a specific executable can be exploited to provide any higher level access. — user1751825, Jun 21, 2016 at 4:49

Rui F Ribeiro · Accepted Answer · 2018-03-12 14:52:11Z

14

Let´s say you want to allow users bellonging to the group users2 to do some privileged control over apache without giving them root privilege.

Add to /etc/sudoers

%users2 keep ALL=NOPASSWD: /sbin/service httpd,/etc/init.d/httpd,/usr/sbin/apache2ctl

If you just want them to restart apache it will be:

%users2 ALL=NOPASSWD: /sbin/service httpd restart,/etc/init.d/httpd restart,/usr/sbin/apache2ctl restart

The users will be able to see what commands they are allowed to use with sudo with:

sudo -l

And to restart Apache they have to spell out exactly the command as they are allowed to run it, for instance:

sudo /sbin/service httpd restart

It is advisable to define the full path of commands in the sudoers file, for security reasons.

answered Jun 21, 2016 at 19:00

Rui F Ribeiro

56.3k26 gold badges149 silver badges228 bronze badges

1

This is tagged as 'centos' so the service name should be 'httpd' not 'apache2'.
– jsbillings
Jun 22, 2016 at 0:42
1

Does the command need to match exactly? For example, is it able to recognize that "$ service http restart" is the same as "$ /sbin/service http restart"? More importantly, will it block sudo access to ~/bin/service, if that's in the users path?
– user1751825
Jun 22, 2016 at 5:41
It needs to match exactly, and it is better that way for security reasons. Otherwise your user could run a script with the same name to escalate to root, as you seem to have already figured out. If the user does not remember the correct path, teach them about sudo -L
– Rui F Ribeiro
Jun 22, 2016 at 6:10
On Ubuntu, /sbin/service does not work but /etc/init.d/ works like a charm.
– Josir
Dec 17, 2018 at 20:16
@Josir /etc/init.d or systemctl for systemd. Do not have my Debian at hand today, will confirm tomorrow.
– Rui F Ribeiro
Dec 17, 2018 at 20:17

| Show 2 more comments

1 Answer 1