I have a third-party application that runs on Linux. The application runs as a specific (non-root) account and provides a quite complicated environment to that user. Without an interactive shell as said user, it is virtually impossible to work with the application due to the environment.
We are now trying to implement some monitoring of this application (monitoring scripts are provided by the application to the mentioned account). We are trying to do the monitoring as a third account that is shared across multiple servers to perform the same monitoring tasks on multiple servers so as to make credential management easier. Because of the complex environment of the application user, we have found that the monitoring user needs to
sudo -i to the application user so that the environment is fully loaded. However, we believe this would require something like this in the sudoers file:
monitor_user ALL=(application_user) NOPASSWD: /bin/bash
/bin/bash is the application user's default shell. However, at this point, anybody with the credentials for the monitoring user can login as the monitoring user and become the application user, which isn't desirable.
Is there a way with
sudo that I can allow a user to run specific commands as the application user with the application user's environment without allowing a full login shell for the monitoring user? We have thought about sourcing the application user's profile in the monitoring scripts, but we have had mixed results with this approach.