2

On Amazon Linux 2018.03, I have a process running as an unprivileged user and calls sudo to run a command. I'm getting the message:

sudo: sorry, you must have a tty to run sudo

The unprivileged user (xymon) is allowed to run the command in question without password

Cmnd_Alias YUM = /usr/bin/yum
xymon   ALL=(ALL)               NOPASSWD: YUM

The command is being called from a perl script executed by the local xymon client process via the following lines:

my $YumCmd  = 'sudo yum check-update  2>&1' ;
@Lines = `$YumCmd` ;

In /etc/sudoers, I have supposedly disabled the tty requirement with:

Defaults    !requiretty

No luck. None of the includes set requiretty.

sudo -ll as the xymon user is below:

Matching Defaults entries for xymon on this host:
!visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS
_XKB_CHARSET XAUTHORITY", !requiretty, secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, requiretty, !visiblepw, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR
LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME
LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", !authenticate

User xymon may run the following commands on this host:

Sudoers entry:
RunAsUsers: ALL
Commands:
    NOPASSWD: /usr/bin/yum

I notice that requiretty does appear in the output but does not appear to be overridden by my Defaults !requiretty directive. Placing the Defaults !requiretty directive at the very end of the sudoers file places it just before the requiretty listed in sudo -ll. No idea where this is coming from.

Using a pseudo-tty with ssh does work using the following command:

my $YumCmd  = 'ssh -tt -i ~/.ssh/id_rsa localhost sudo yum check-update  2>&1' ;

This is not a good option given the large amount of setup needed for the many servers to run this script (Xymon script). Any suggestions for getting this to work with sudo or is this a bug?

  • Is sudo configured to ask for a password when the process running as an unprivileged user runs? – dsstorefile1 May 10 '18 at 21:33
  • check the answer of this Q. unix.stackexchange.com/questions/79960/… – Michael D. May 10 '18 at 21:44
  • I've updated my question to answer the query from @dsstorefile1 – JohnA May 10 '18 at 21:45
  • 1
    Can you su xymon and check the output of sudo -ll ? – Michael D. May 10 '18 at 21:53
  • 4
    I see both !requiretty and requiretty in your sudo -ll output. Later rules usually win. Can you track down where the second one is coming by from? – Mark Plotnick May 10 '18 at 22:41
2

Issue solved. I had included requiretty in my LDAP.

cn=defaults,OU=SUDOers sudoOption requiretty changed to !requiretty and all works properly.

I will now limit !requiretty to just the affected user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.