Allowing non root users to manage systemd service is not working

Question

I wanted to allow specific non root users to start/stop certain systemd services in CentOS7. But there has been no luck on the steps that I have tried so far. Here is what I have tried.

I have added the below details in sudoers file where testsudo is a user group and couple of users have been added to that group.

## Manage specific systemd services
Cmnd_Alias SYSTEMD = /bin/systemctl start httpd, /bin/systemctl stop httpd, /bin/systemctl restart httpd

## Allows nfam group to run init-system commands using the SYSTEMD command alias
%testsudo ALL=NOPASSWD: SYSTEMD

Details of the group and added users:

# cat /etc/group | grep testsudo
testsudo:x:1009:userone,usertwo,userthree

Now if I try to start the service using any one of the user (who is a part of testsudo group), I get an authentication required message.

[userone@msgdroid ~]$ systemctl start httpd
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Multiple identities can be used for authentication:
 1.  admin
 2.  priya
 3.  sekar
 4.  gokul
 5.  ravi
 6.  murali
Choose identity to authenticate as (1-6):

Update1:

I have also used sudo infront of the command, but it doesn't work even.

$ sudo systemctl start httpd
[sudo] password for userone:
Sorry, user userone is not allowed to execute '/bin/systemctl start httpd' as root on webapp.

Update2:

• Just a correction, the server can only be accessed via SSH Keys and not via password. Will that be an issue?

Answer 1

I suggest you to try this:

sudo systemctl start httpd

You have to log out then log in again after you modified you sudoers file (you may not be able to use sudo until you do this).

You can also edit and replace the following:

%testsudo ALL=NOPASSWD: SYSTEMD

with

%testsudo ALL=(root) NOPASSWD: SYSTEMD

Answer 2

If using sudoers, then you need to use sudo but you can hide its use in a script or alias.

I am wondering if the problem is that your users are not yet in the group. Adding a user to a new group, only writes to a file (/etc/groups). To activate it you need to start a new process, with the new group. There are two easy ways to do this: 1 logout and back in again; run newgrp groupname. This will start a new shell over the current one. It will be added to the new group, if and only if you are a member of the group (according to the file /etc/groups).