4

I am writing a shell script where I want to automate service Restart process on multiple Unix servers. I as a normal user do not have rights to run services restart commands. Only s_user has rights to run them.

Procedure to restart services:

  1. Login to server with my username and password.
  2. To Run the Restart service I need to switch user to s_user using below command: ( I need this command without password prompt)

    sudo su - s_user 
    

The above command prompts for password where I will provide my password to restart services. This procedure I have to do in all the servers.I want to skip the password prompt by supplying the password to su through stdin.

The following commands I have tried so far:

1.   echo 'password'|sudo -S su -c " .../bin/services stop" 
Output:
[sudo]password for abc.xyz: Sorry, user abc.xyz is not allowed to execute '/bin/su - s_user' -c /bin/services stop' as root on [Servername]                        

In the above command I gave my password. I have also tried giving the s_user password but it gives below output:

[sudo]password for abc.xyz: Sorry,try again.
[sudo]password for abc.xyz:
sudo:pam_authenticate:Conversation error

I replaced ‘su’ with ‘u’ in the below command, but still I am getting the same output error as 1st command.

2.  echo 'password'|sudo -S u -c " .../bin/services stop" 

I have provided s_user in the below command, but still I am getting the same output error as 1st command.

3.  echo 'password'|sudo -S su - s_user -c ".../bin/service stop" 

Next I have tried the below command.

4.  echo 'my password'|su -c ".../bin/services stop" -s /bin/sh abc.xyz
Output:
Standard in must be a tty

I have also tried the below command.

5.  su -c "command_to_restart_the_services" -s /bin/sh abc.xyz 

I am able to run the command successfully.

6.  echo password|sudo -S su - user-to-switch
    sudo -S su - user-to-switch

The above command still ask for the password.

Restrictions:

• I cannot use “expect”, it’s not installed in my machines.

• I cannot edit the "sudoer" file. I do not have rights.

  • I would convince the sysadmin to configure sudo to allow me to restart the services directly, with or without a password prompt as desired. – a CVn Aug 20 '16 at 19:51
  • single sign-on feature – overexchange Mar 28 '18 at 0:17
  • You don't need to use su with sudo. sudo has an option to specify a sure -u. And your admin gave you full root access, using sudo. Add the sudo configuration yourself. – ctrl-alt-delor Jul 3 '18 at 23:22
2

I see you are using sudo to become root, and then su to become s_user. To do this you will use your password (for sudo). You do not need the password for s_user.

You could do it by instead adding your ssh key to the s_user account, but I think this solution in this case is sub-optimal.

First I will point out that you don't need su, and it is best not to use it. So instead of sudo su - s_user -c command, do sudo -u s_user command. You will still be asked for your password. However you can now configure /etc/sudoers

Add a file /etc/sudoers.d/s_commands, containing something like (but checked, with /usr/bin/visudo):

Cmnd_Alias S_COMMAND=/usr/bin/command, /usr/bin/anotherCommand
%s_group ALL = (s_user) NOPASSWD : S_COMMAND

This will allow password less use of those commands, as s_user, but only for users in group s_group (you will have to add the group).

Then set up a shell alias, something like: alias s_command="sudo -u s_user command".


Notes:

  • su takes the password of the user that you are switching to.
  • sudo, by default, takes the password of the user you are (you are switching from).
  • sudo does not read password from stdin, it reads from tty.
1

A way to do this is to use ssh.

Using ssh-copy-id you can store the authentification:

ssh-copy-id s_user@127.0.0.1

(if no key have been set, use ssh-keygen to generate one)

Next you can use ssh instead of sudo to execute command without password prompt:

ssh s_user@127.0.0.1 " .../bin/services stop"
  • Thanks for your reply, I am new to this unix environment. Can you please provide some more details on when to run this command i mean after doing sudo login? Also, I am not sure what would be the impact post implementing these. These servers are currently in use and I am afraid if something goes wrong.Can you please provide me step by step guide to perform this authenfication task. Please help!!! – Arshad Sahail Aug 21 '16 at 20:35
  • Somehow the ssh s_user@127.0.0.1 command makes something equivalent to sudo -u s_user, after running ssh-copy-id s_user@127.0.0.1 that prompt for password the ssh command doesnot prompt for password. – mpromonet Aug 21 '16 at 21:26
0

This is not exactly the answer to your question, but could be a solution for your task.

I suppose you know the password for s_user on every server, and there is sshd installed on those servers (and works as expected; depends on what OS runs on the servers).

As mpromonet stated, you may use ssh, but without logging into the servers with your own credentials.

On your computer:

First, generate your own key pair with ssh-keygen. This will be stored in ~/.ssh directory by default.

Next, for every server involved call ssh-copy s_user@<server>; you will be asked for the password of s_user on the server.

Now to check if all went well just try ssh s_user@<server>. If this works without being asked for a password your done.

In your script (on your local computer) you now can call

ssh s_user@<server> "whatever-command-you-need-to-run"

without beeing asked for passwords.

Rem.: I supposed here your local computer runs a UN*X like OS as well. If you are running Windows, you may instead use the programs coming with the putty packet for Windows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.