0

This is a sudoers file which I have on a Debian 9 server and it works. /etc/sudoers contains:

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root        ALL=(ALL:ALL) ALL
# the following line I've added for sudo to work on Debian, which by default does not
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Meaning I can now run e.g. the following without entering password:

sudo teamviewer daemon disable
sudo teamviewer daemon enable

This, however, is a non-working sudoers file on Linux Mint 18 in a sense, it still asks me for password. /etc/sudoers contains:

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root        ALL=(ALL:ALL) ALL
# this line I've added myself, because I felt it is needed, however user vlastimil has had sudo access all the time, added just now
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish, but it does not work
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

I guess there is some difference between Debian and Mint, which makes the added lines non-working.

I read different answers like on this page:

How to run a specific program as root without a password prompt?

But I am not clever from it.

EDIT1:

The first answer gives on Linux Mint a strange error:

$ sudo /usr/bin/teamviewer
 Init...
 *** TeamViewer can not be executed with sudo! ***
 Either use your normal user account without sudo
 or use a the real root account to log in to your desktop (not recommended!).

I don't get this either.


$ which teamviewer
/usr/bin/teamviewer

$ file /usr/bin/teamviewer
/usr/bin/teamviewer: symbolic link to /opt/teamviewer/tv_bin/script/teamviewer

$ file /opt/teamviewer/tv_bin/script/teamviewer 
/opt/teamviewer/tv_bin/script/teamviewer: Bourne-Again shell script, ASCII text executable

$ cat /opt/teamviewer/tv_bin/script/teamviewer
#!/bin/bash

# If you see this message, you probably attempted to start TeamViewer.
# Please open a terminal (Konsole, gnome-terminal, xterm),
# navigate to this folder (type 'cd /path/to/teamviewer' [Enter])
# then execute TeamViewer (type './teamviewer' [Enter])


TV_SCRIPT_DIR="$(dirname "$(readlink -e "$0")")"
source "$TV_SCRIPT_DIR/tvw_main"

Main "$@"

EDIT2:

For instance on AskUbuntu, as suggested in comments:

Why is sudoers NOPASSWD option not working?

and on many other places, there is a solution where they put the rule after admin group rule. I've tried it, even rebooted afterwards, but it's still not working.

  • possible duplicate of askubuntu.com/questions/100051/… – rajaganesh87 Oct 31 '17 at 17:42
  • 1
    @rajaganesh87 duplicates can be sourced only from the same site – LinuxSecurityFreak Oct 31 '17 at 17:57
  • I'm confused by your statement "Meaning I can now run e.g. the following without the use of sudo: teamviewer daemon disable" -- directly after your first sudoers example. There's a sudo rule for your user to run (sudo) teamviewer; did you mean to say "Meaning I can now run the following without a password prompt"? – Jeff Schaller Nov 1 '17 at 1:01
  • @JeffSchaller Thank you for pointing the big-a** error out. Fixed it. I don't really know how I put such non-sense sentence together. – LinuxSecurityFreak Nov 1 '17 at 6:18
2
# this line I've added myself, because I felt it is needed, however user vlastimil has had sudo access all the time, added just now
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish, but it does not work
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

That first comment suggests that your user is a member of the sudo group, which is how users on Linux Mint get sudo access by default. And the sudo group's rule comes later:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

The last matching rule wins. It doesn't matter that vlastimil has a NOPASSWD rule earlier on when this later rule also applies. The NOPASSWD rule should come after this one. That is why using a file in /etc/sudoers.d works, because these files are included last of all:

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

If you are going to add multiple files to sudoers.d, use a numbered filename convention (XX-somefile), so that you can order them reliably and ensure proper precedence of rules.

0

One solution on Linux Mint 18.2 which is based on Ubuntu 16.04 is creating a separate sudoers file using visudo, for example:

sudo visudo -f /etc/sudoers.d/teamviewer

and putting the extra line:

vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

into it. It may very well be also the most elegant solution, but that is a matter of opinion.

-1

It’s the absolute path defined for the teamviewer binary.

Why not try the following as the vlastimil user

$ sudo /usr/bin/teamviewer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.