0

For developing a game server I want to git push my current stable to a private VPS. Inside the git-hook receive the following should happen

sudo systemctl stop myserver
dotnet publish --configuration release
sudo systemctl start myserver

Inside the myserver.service the compiled binary is run as the user that has access to the git-repository.

My idea now was to replace the first and last line by scripts owned by root and readable by everyone so the git-hook receive turns into

sudo stop-server.sh 
dotnet publish --configuration release
sudo start-server.sh

As a final step I want to allow the user privileges to sudo-invoke both scripts but nothing else. In addition the scripts executed without having sudo ask for the users password since there is no interaction possible.

1

You can append the following to /etc/sudoers (or create a new file inside /etc/sudoers.d/):

<username> ALL=(ALL) NOPASSWD: /path/to/script

That would make running sudo /path/to/script as the <username> user passwordless. Note that it is insecure if the contents of the script can be modified by a malicious user, and you are better off trying to avoid needing root privileges altogether.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.