3

On my Debian Stretch system, I have

Defaults        env_reset

in my /etc/sudoers. I want to set up my system so that when running sshuttle, I don't have to enter my password for the call

sudo PYTHONPATH=/usr/lib/python3/dist-packages -- /usr/bin/python3 \
                                                  /usr/bin/sshuttle --method auto --firewall

So I created a file /etc/sudoers.d/sshuttle with the contents

username    ALL=NOPASSWD: /usr/bin/python3 /usr/bin/sshuttle --method auto --firewall

However, I get the error message

sudo: sorry, you are not allowed to set the following environment variables: PYTHONPATH

The optimal solution

  1. should allow me to run exactly this one command with setting the PYTHONPATH, but would not affect the security of my sudo setup in, general, i.e., this restriction should still apply for the other entries in my sudoers files.
  2. would not require me to change the sshuttle source code, i.e., it should work for the exact command specified above without modification.

What I tried so far:

  1. modify the /etc/sudoers.d/sshuttle file to read username ALL=NOPASSWD: PYTHONPATH=/usr/lib/python3/dist-packages /usr/bin/python3 /usr/bin/sshuttle --method auto --firewall, but this seems not to be valid syntax

Notes:

  1. I do not want to run the whole sshuttle command via sudo, as a) sshuttle doesn't need root rights except for the firewall part (the command this question about), and b) because then I always need to enter the passphrase for my SSH key (which is usually unlocked via gpg-agent for my own user, but not for the root user).
  • 1
    Did you try with SETENV? (see sudoers manual). – Kusalananda Jan 21 '17 at 17:52
  • I'd love to write it up as an answer, but I have no way of testing it (no sudo on my OpenBSD machine, we use doas), so someone else has to do that. – Kusalananda Jan 21 '17 at 22:10
3

If the PYTHONPATH you need is constant, you can use /usr/bin/env (most underrated unix tool ever...):

username    ALL=NOPASSWD: /usr/bin/env PYTHONPATH=/usr/lib/python3/dist-packages /usr/bin/python3 /usr/bin/sshuttle --method auto --firewall

Or write a short wrapper script that sets up the environment before execing the python script.

If the PYTHONPATH is not constant, you might just as well use username ALL=NOPASSWD: ALL, since the user could override any python package that is used by sshuttle and put code doing anything imaginable in there.

  • Thanks, yes, PYTHONPATH is constant. However, for your suggestion, I'd need to modify the sshuttle source code (to put the /usr/bin/env ... there), and I'd prefer not to do this. I'll go with SETENV, as suggested by @Kusalanada in the comments. – andreas-h Jan 21 '17 at 21:58
  • As I said, in this case you are completely opening up your system, since the user can set PYTHONPATH to anything she likes, making sshuttle do anything she wants with full root permissions. With SETENV, you allow the user to control the environment for the privileged process, without any restrictions whatsoever. – aferber Jan 22 '17 at 3:45
  • Try it: mkdir /tmp/sshuttle; echo -e 'import os\nos.system("echo Gotcha; id")' > /tmp/sshuttle/cmdline.py; sudo PYTHONPATH=/tmp /usr/bin/python3 /usr/bin/sshuttle --method auto --firewall – aferber Jan 22 '17 at 3:55
  • thanks, @aferber , for your concerns. you actually convinced me that this is the better solution. so I'll try to get a corresponding patch merged upstream into sshuttle, to allow for this setup. – andreas-h Jan 23 '17 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.