3

I wanted to allow specific non root users to start/stop certain systemd services in CentOS7. But there has been no luck on the steps that I have tried so far. Here is what I have tried.

I have added the below details in sudoers file where testsudo is a user group and couple of users have been added to that group.

## Manage specific systemd services
Cmnd_Alias SYSTEMD = /bin/systemctl start httpd, /bin/systemctl stop httpd, /bin/systemctl restart httpd

## Allows nfam group to run init-system commands using the SYSTEMD command alias
%testsudo ALL=NOPASSWD: SYSTEMD

Details of the group and added users:

# cat /etc/group | grep testsudo
testsudo:x:1009:userone,usertwo,userthree

Now if I try to start the service using any one of the user (who is a part of testsudo group), I get an authentication required message.

[userone@msgdroid ~]$ systemctl start httpd
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Multiple identities can be used for authentication:
 1.  admin
 2.  priya
 3.  sekar
 4.  gokul
 5.  ravi
 6.  murali
Choose identity to authenticate as (1-6):

Update1:

I have also used sudo infront of the command, but it doesn't work even.

$ sudo systemctl start httpd
[sudo] password for userone:
Sorry, user userone is not allowed to execute '/bin/systemctl start httpd' as root on webapp.

Update2:

  • Just a correction, the server can only be accessed via SSH Keys and not via password. Will that be an issue?
  • You edited sudoers but didn't invoke sudo; do you want to use sudoers? – Jeff Schaller Nov 27 '18 at 11:56
  • @JeffSchaller, is there any other alternate approach without using sudoers? – Parthasarathy Venugopal Nov 27 '18 at 12:03
  • Is testsudo a member of the sudo group? If not then that won't work as printed. Because userone may be in testsudo but if testsudo is not in sudo the resultis the same. – Michael Prokopec Nov 27 '18 at 13:29
  • I tested your configuration on a Debian server and it works. I suggest you to double check the syntax of the commands you entered in sudoers file (did you use visudo to do this ?). Check the spaces are spaces (and not alt-space e.g.), eventually rewrite it from zero. – lauhub Nov 27 '18 at 14:06
  • 2
    It'd be interesting to see the output from sudo -l as userone on that system. Access via keys is no problem, as it appears that you know the password for the userone user. – Jeff Schaller Nov 27 '18 at 14:12
0

I suggest you to try this:

sudo systemctl start httpd

You have to log out then log in again after you modified you sudoers file (you may not be able to use sudo until you do this).

You can also edit and replace the following:

%testsudo ALL=NOPASSWD: SYSTEMD

with

%testsudo ALL=(root) NOPASSWD: SYSTEMD
  • Tried adding sudo but it doesn't help. Updated the question. – Parthasarathy Venugopal Nov 27 '18 at 12:02
  • Did you log out from userone then log in again ? – lauhub Nov 27 '18 at 12:04
  • Yes I have logged out and logged in back. – Parthasarathy Venugopal Nov 27 '18 at 12:05
  • 2
    %testsudo ALL=(root) NOPASSWD: SYSTEMD translated to English: members of group "testsudo" on ALL hosts using this sudoers file are allowed to execute as root, without being asked for a password, any commands defined earlier on a CmndAlias SYSTEMD line. – telcoM Nov 27 '18 at 14:48
  • 1
    The percent sign before the word testsudo means it is a group not an user. And the original poster says that the users that need to run the commands have already been added to the testsudo group. – telcoM Nov 27 '18 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.