3

On my Linux Red Hat machines, I do the following from root

# su - starus
$                <--   now I am in starus user

$ su - moon      <-- now I want to access moon user from starus user
Password:

But I get prompted for a password!

Please advise why I get password if already added in visudo the following

moon ALL=(starus) NOPASSWD: ALL

What is wrong?

I also try to run the following script as user moon but password is needed

starus@host sudo -u moon  /home/USER261/test.bash
[sudo] password for starus:
6

First of all, root can become any user without needing a password. That's one of the privileges of being the super user. So, with su - starus, you can switch to starus without being prompted. However, at that point, you are starus and no longer root, so you do need a password to switch to moon.

The simple solution is to switch back to root first (just run exit) and then switch to moon.

Now, visudo is irrelevant here. You're not using sudo so any changes you make there (in /etc/sudoers, the file that visudo edits) won't affect the behavior of su, only that of sudo which is not the same program.

In any case, the line you show (moon ALL=(starus) NOPASSWD: ALL) simply means that the user moon can run any command as the user starus with sudo without needing to enter a password. It doesn't mean that anyone can become moon without knowing moon's password. It just means that commands like this don't need a password:

moon@host $ sudo -u starus command

If you are logged in as moon, you can use sudo to run a command as starus without a password.

  • see please my update " sudo -u moon /home/USER261/test.bash" I also try to run command as script from user moon but password again appears – yael Mar 27 '17 at 12:27
  • @yael yes, because you are starus trying to run as moon and not moon trying to run as starus. If you are moon, you can do sudo -u starus with no password, but if you are starus you still need a password to run things as moon. – terdon Mar 27 '17 at 12:30
3

The simple answer is that the /etc/sudoers file is only used by the sudo program – not su.

It is not used by the su program which starts a new shell as the specified user. When you run su - moon, you’re starting a new login shell as the moon user and you’ll be prompted for that user’s password. When running this command as root, you aren’t prompted for the user’s password since root is the superuser and could change the password if it wanted to. However, when running the command as the starus user, you’re not a superuser and must authenticate as normal.

On the other hand, the edits that you’ve made to /etc/sudoers allow the starus user to use the sudo command with the -u option to run commands as the moon user (without being prompted for a password). E.g., while logged in as starus, you could run the following command:

sudo -u moon touch /home/moon/test.file

Running sudo -u moon ls -l /home/moon/test.file would show that the newly created test.file is owned by the moon user (as if it was moon that ran the command and not starus).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.