4

What is the difference between the lines below.

user1 ALL=(ALL) NOPASSWD: /etc/init.d/service-script
user1 ALL=NOPASSWD:/etc/init.d/service-script

Is both the lines correct and any difference ? I need to provide sudo access to user1 to execute the service script.

Improve this question
0

2 Answers 2

Reset to default
3

First line has correct syntax.

user1 ALL=(ALL) NOPASSWD: /etc/init.d/service-script

It means: user1 can, on ALL hosts that use this /etc/sudoers file, become ALL users to run /etc/init.d/service-script without a password request.

The second line has incorrect syntax, at least for modern versions of sudo. If you edited /etc/sudoers with the recommended visudo command, you would get a message similar to this after exiting your favorite editor:

File /etc/sudoers.tmp saved
>>> /etc/sudoers: syntax error near line 28 <<<
What now?

By typing a question mark, you would get a list of options:

Options are:
  (e)dit sudoers file again
  e(x)it without saving changes to sudoers file
  (Q)uit and save changes to sudoers file (DANGER!)

What now?

It would be best to select either 'e' and remove the incorrect line, or 'x' to discard all edits you made this time.

You might want to type a comment like this in your /etc/sudoers file to remind you of the correct syntax:

# WHO  WHERE = (AS WHOM) WHAT

Between the (AS WHOM) and WHAT parts, you can optionally add a few colon-terminated tags that can affect some details of the procedure.

Since the service-script is located in /etc/init.d, it apparently is intended to be run as root. So the "optimal" /etc/sudoers line would be:

user1 ALL=(root) NOPASSWD: /etc/init.d/service-script

The user should run it as:

sudo /etc/init.d/service-script

or explicitly

sudo -u root /etc/init.d/service-script

Adding arguments to the end of the command line is allowed.

Improve this answer
1
  • I did added the line "user1 ALL=(ALL) NOPASSWD: /etc/init.d/service-script" and it works perfectly. I haven't tested the second one syntactically since first one worked. Its a detailed answer and elegant.
    – intechops6
    Commented Apr 26, 2018 at 13:30
1

Both will do what you expect, the difference is that the first one would allow user1 to run the command as any other user. In the second one, the command will run as root (which is more probably what you expect).

Improve this answer
4
  • Is the second one "user1 ALL=NOPASSWD:/etc/init.d/service-script" syntactically correct? what if (ALL) in the line is missing. Will it run the script as root by default.
    – intechops6
    Commented Apr 26, 2018 at 13:32
  • 1
    I tried it with Debian 9's visudo, with the exact results shown in my answer. Maybe older versions of sudo are less strict on syntax.
    – telcoM
    Commented Apr 26, 2018 at 14:02
  • 1
    sudo 1.8 (centos7) accepts both syntaxes. The missing (ALL) will prevent to sudo to an other user than root.
    – tonioc
    Commented Apr 26, 2018 at 15:27
  • Nice to know how these syntax differences.
    – intechops6
    Commented May 4, 2018 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .