1

I'm logged in as user1 and I have two scripts, script1 attempts to call script2 using sudo -u user2. My problem is that I'm still prompted to enter password for user1 although I'm specifying -u option for sudo. Here is my setup:

  1. Script1:

    #! /bin/bash
    
    echo "Current user in script1:" $USER
    
    # Call script2
    sudo -u user2 /full/path/to/script2
    
  2. Script2:

    #! /bin/bash
    
    echo "Current user in script2:" $USER
    
    # Execute command as user2
    some-command-that-works
    
  3. Equivalent /etc/sudoers to the one I have:

    # /etc/sudoers
    #
    # This file MUST be edited with the 'visudo' command as root.
    #
    # See the man page for details on how to write a sudoers file.
    #
    
    Defaults        env_reset
    
    # Host alias specification
    
    # User alias specification
    
    # Cmnd alias specification
    
    # User privilege specification
    user1 ALL=(ALL:ALL) ALL
    
    
    # Allow members of group sudo to execute any command
    # (Note that later entries override this, so you might need to move
    # it further down)
    %sudo ALL=(ALL) ALL
    #
    #includedir /etc/sudoers.d
    
    # Don't ask for user2 password for script2
    user2 ALL= NOPASSWD: /full/path/to/script2
    
    # FYI: I experimented with the line below for group1 that user1 is a member of
    %group1 ALL= NOPASSWD: /full/path/to/script2
    
  4. ls -blah output

    drwxrwsr-x 2 user1 group1 4.0K Oct 19 15:22 .
    drwxrwsr-x 7 user1 group1 4.0K Oct 18 18:48 ..
    -rwxrwxr-x 1 user1 group1  180 Oct 20 17:37 script1
    -rwx------ 1 user2 group1  166 Oct 20 16:29 script2
    

An example of my shell attempt to run script1:

user1@host1 /full/path/to/script1 $ script1
Current user in script1: user1
[sudo] password for user1:

Edit: This is on a server that I connect to with ssh. The server is running Debian 6.0.4 Squeeze

  • In case you hadn't realised, user1 ALL=(ALL:ALL) ALL allows user1 to run any command as any user - including root. – roaima Oct 21 '17 at 21:59
5

sudo -u <user> gives a user permission to run a command as the given user.

It is not the same as su - <user>, which switches you to the given user. su - <user> requires you to enter the password for the given user in order to open a session as that user.

sudo -u <user> requires the current users password unless the NOPASSWD: flag is given in the sudoers file.

To achieve your desired functionality add this to your sudoers file

%group1 ALL=(user2) NOPASSWD: /full/path/to/script2

This will allow group1 to run script2 as user2 without entering a password.

  • Infact, user1 is a part of group that needs the same functionality. As you see in the last line my etc\sudoers, I was trying to give NOPASSWD to group1 for script1 but to no avail. – mbadawi23 Oct 21 '17 at 19:00
  • run sudo -l /full/path/to/script2. I suspect that the user1 ALL=(ALL:ALL) ALL is taking precedence over the lower group directive. The ouput from sudo -l should show NOPASSWD: if that is in effect. – Dave Evans Oct 21 '17 at 19:29
  • Here is what I got for sudo -l /full/path/to/script2: /full/path/to/script2, and nothing else. It just listed the path to the script. – mbadawi23 Oct 21 '17 at 20:27
  • I don't understand why this line: %group1 ALL= NOPASSWD: /full/path/to/script2 is not taking precedence over the rest of the sudoers file. – mbadawi23 Oct 21 '17 at 20:48
  • Also, I tried user1 user2= :NOPASSWORD /full/path/to/script2 in /etc/sudoers but visudo could not parse it. – mbadawi23 Oct 21 '17 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.