I have two users
tomcat neither of them have a password.
How can I allow
dev 1 do
su - tomcat without having him having to enter any credentials?
1 connects with ssh keyfile
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You have sudo added to your tags. In your sudoers file, you can add dev to allowed users and, if you wish, restrict which commands they're allowed to run, and that password isn't required. Then all they'd have to do is type "sudo su - tomcat".
visudo to add the following line:
dev ALL = NOPASSWD: /usr/bin/su - tomcat
There's lots more information and examples in the man file for sudoers.
This is how I ended up doing it.
I created the file
# allow user dev to become user tomcat # invoked with [dev@host ~]$ sudo su - tomcat dev ALL = (root) NOPASSWD: /bin/su - tomcat
changed the file permissions with
chmod 0440 /etc/sudoers.d/dev
created an alias in dev's
alias tomcat='sudo su - tomcat'
This results in the ability for the dev user to become the tomcat user without either having to type (or indeed having) a password ever by typing
tomcat at the command line.
I've been using sudo's built in user assumption tool,
devis the sudoer user name, or
devis the sudeoer group name (sudo configuration calls this
tomcatis the destination user
/!\ Note, always validate sudo's configuration files with
visudobefore writing, or always edit sudo's configuration files with
visudo. An invalid sudo configuration file will latch sudo in an broken state and prevent further invocations.
sudo env EDITOR=nano visudo -f /etc/sudoers.d/runas-tomcat
#/etc/sudoers.d/runas-tomcat dev ALL=(tomcat) NOPASSWD: ALL %dev ALL=(tomcat) NOPASSWD: ALL
Using sudo like this is simmilar to as follows. The flag
-H) is optional, it corrects
$HOME by looking it up the target user home in
/etc/passwd. The flag
-i) is optional,
-s uses your shell and should feel at home,
-i instead uses the target user shell specified in
/etc/passwd which may be
/usr/sbin/nologin for example and deny login; if both
-i are not provided, sudo requires additional non-flag arguments to speciify what command to run.
dev@localhost ~ $ sudo --set-home --shell --user tomcat tomcat@localhost /home/dev/ $ cd tomcat@localhost ~ $
or in shorter form
sudo -u tomcat echo whoami sudo -Hsu tomcat # enter tomcat with your shell and their home