10

We have production centos servers that run apache as root to allow low port numbers (80 and 443).

We'd like a secure way for non-root users to restart apache.

Are there any security implications with adding something like this to the sudoers file...

username    ALL=NOPASSWD:/usr/bin/service apache2 reload

Specifically I'd like to know if there is any way for the user to then elevate their privileges, or somehow run other programs as root.

4
  • this might help you.
    – Rahul
    Commented Jun 21, 2016 at 4:34
  • link is already provided
    – Rahul
    Commented Jun 21, 2016 at 4:40
  • @Rahul This is useful. However it seems to be mostly discussing the implications of NOPASSWD sudo access generally. What I want to do is use it from a release script, where entering a password is impossible. The user already has ssh access to the machine, but doesn't have any sudo access currently. I'm just wondering if sudo access to a specific executable can be exploited to provide any higher level access. Commented Jun 21, 2016 at 4:49
  • AFAIK No it doesn't.
    – Rahul
    Commented Jun 21, 2016 at 5:00

1 Answer 1

14

Let´s say you want to allow users bellonging to the group users2 to do some privileged control over apache without giving them root privilege.

Add to /etc/sudoers

%users2 keep ALL=NOPASSWD: /sbin/service httpd,/etc/init.d/httpd,/usr/sbin/apache2ctl

If you just want them to restart apache it will be:

%users2 ALL=NOPASSWD: /sbin/service httpd restart,/etc/init.d/httpd restart,/usr/sbin/apache2ctl restart

The users will be able to see what commands they are allowed to use with sudo with:

sudo -l

And to restart Apache they have to spell out exactly the command as they are allowed to run it, for instance:

sudo /sbin/service httpd restart

It is advisable to define the full path of commands in the sudoers file, for security reasons.

7
  • 1
    This is tagged as 'centos' so the service name should be 'httpd' not 'apache2'.
    – jsbillings
    Commented Jun 22, 2016 at 0:42
  • 1
    Does the command need to match exactly? For example, is it able to recognize that "$ service http restart" is the same as "$ /sbin/service http restart"? More importantly, will it block sudo access to ~/bin/service, if that's in the users path? Commented Jun 22, 2016 at 5:41
  • It needs to match exactly, and it is better that way for security reasons. Otherwise your user could run a script with the same name to escalate to root, as you seem to have already figured out. If the user does not remember the correct path, teach them about sudo -L Commented Jun 22, 2016 at 6:10
  • On Ubuntu, /sbin/service does not work but /etc/init.d/ works like a charm.
    – Josir
    Commented Dec 17, 2018 at 20:16
  • @Josir /etc/init.d or systemctl for systemd. Do not have my Debian at hand today, will confirm tomorrow. Commented Dec 17, 2018 at 20:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .