15

I have granted a group permission to run certain commands with no password via sudo. When one of the users makes a typo or runs the wrong command the system prompts them for their password and then they get an error. This is confusing for the user so I'd like to just display an error instead of prompting them for a password. Is this possible?

Here is an example of my sudoers file:

%mygroup ALL=(ALL) NOPASSWD:/usr/local/bin/myscript.sh *

Example when they run the wrong script:

# sudo /usr/local/bin/otherscript.sh
[sudo] password for user:
Sorry, user user is not allowed to execute '/usr/local/bin/otherscript.sh' as root on <hostname>.

Desired output:

Sorry, user user is not allowed to execute '/usr/local/bin/otherscript.sh' as root on <hostname>. Please check the command and try again.

Note the lack of password prompt.

My google-fu has failed me and only returns results on not asking for a password when the user is permitted to run the command.

  • 8
    If that were possible, it could open a (small) security hole. If you've left yourself logged in and I "borrow" your keyboard, I can't see what commands sudo will let you execute without entering your password. With the feature you want, I could get that information for specific commands. – Keith Thompson Aug 16 '16 at 18:48
  • 4
    This is a pretty big security issue.You should not use sudo with scripts as the command. People can just edit the script and run what ever they want totally masking it from an audit. Instead add the call to sudo inside the script. – coteyr Aug 17 '16 at 1:22
  • 1
    @coteyr running binary files with sudo is just as big of an issue, if users have write access to these files. – Dmitry Grigoryev Aug 17 '16 at 10:57
  • 1
    @CarlWitthoft that's why you use absolute paths to specify allowed programs in sudoers. – Dmitry Grigoryev Aug 17 '16 at 13:36
  • 1
    @DmitryGrigoryev, yes, but if your going to use sed or some such for just one file then there is no benefit to sudo. Allowing a user to modify a file is why files have permissions. You don't have to reinvent the wheel. If you want a user to be able to modify a file, then let them. There's no need, or benefit to jump through hoops with sudo to allow a user to modify a file, without a password. You can always just allow them to. Right tool for the right job. – coteyr Aug 17 '16 at 14:21
25

From a quick read of sudo(8)

   -n          The -n (non-interactive) option prevents sudo from
               prompting the user for a password.  If a password is
               required for the command to run, sudo will display an error
               message and exit.

And for the doubters:

# grep jdoe /etc/sudoers
jdoe    ALL=(ALL) NOPASSWD: /bin/echo
#

Tested thusly:

% sudo echo allowed
allowed
% sudo -n ed             
sudo: a password is required
% sudo ed               

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

Password:

So an alias for sudo for these folks would likely do the trick, to prevent the password prompt. Now why this requires custom compiling sudo, I don't know, I just read the manual.

  • Indeed. I'd put something like alias sudo="$(which sudo) -n" in /etc/bashrc, then use either sudo (adjusted behavior) or command sudo (default behavior) as desired. – a CVn Aug 17 '16 at 10:55
7

One thing that worked for me, (Sudo version 1.8.17p1), but satisfies only part of your problem, is to set the number of password tries to 0.

Defaults:%mygroup passwd_tries = 0

This makes sudo exit with code 1 when any command requiring a password is tried. However, it doesn't produce any sort of error message.

  • This is also a valid answer but the lack of error message might be confusing. The correct yet unexpected error from the answer above is also confusing though. It's a toss up I guess. Thank you for providing an alternative answer, options are always appreciated! – user184982 Aug 16 '16 at 22:17
2

You can not.

There is no way to tell who you are until you have authenticated, and, by default you can not authenticate without a password.

You could change authentication to use USB keys, finger print scanners, voice auth, face recognition, or a bunch of other stuff, but the point is the same.

You can not authenticate, with out authenticating AND before you authenticate sudo has no business telling you what you can or can not run.

  • 2
    Typing your password when you run sudo is not identification (“tell who you are”). Sudo knows who you are. Typing your password is presence confirmation. – Gilles Aug 16 '16 at 23:43
  • I consider presence confirmation as "authentication". As in Authentication, then Authorization. – coteyr Aug 17 '16 at 1:19
  • 2
    The answer says "authentication" not "identification". While sudo does know who you claim to be, based on the user who is logged in on that terminal, it does not know who you are until you have authenticated that identity. – Dave Sherohman Aug 17 '16 at 7:42
2

@StrongBad made a comment that deserves to be an answer:

I think the best solution would be to write a wrapper script that always calls sudo with the correct parameters. (Including -n)

The wrapper script can do argument parsing etc. so that the called sudo script gets as small as possible and therefore less likely to have bugs.

1

This is not possible. The only way is to change the source code and compile your own fork of sudo

  • You're right, but I don't think I'm going to get permission to load a custom version of sudo on all of our production servers. hah – user184982 Aug 16 '16 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.