0

I have some sudo rules setup for many (virtual) servers (mostly debian) to be used by zabbix scripts:

zabbix ALL=NOPASSWD: /etc/init.d/exim4 restart

The zabbix-agent and sudo configuration file (/etc/sudoers.d/zabbix-agent) is distributed via ansible, and is the same for all servers.

However, on some servers, sudo asks for a password. On others, it does not. It is the same whether I run the command using zabbix, or locally:

# sudo -u zabbix sudo /etc/init.d/exim4 restart

Sometimes, it works and sometimes it asks for the password.

I looked into it, and the obvious answer that there is a different rule for the zabbix user in the sudo config is not true.

What other factors could result in the system asking for a password anyway?

0

Ok, there were two error sources:

  1. The sudoers.d directory was not included in /etc/sudoers. On most modern systems this is the default, and thus just dropping the file works, but there were some old systems that were originally installed with Debian Lenny, and kept the old sudoers file.
  2. No exim was installed, so /etc/init.d/exim4 was nonexistent. Now this is also a user error in a way, but it is also very crappy error reporting for sudo. I understand that reporting about trying to execute some files may result in an information leak (there is, however, an explicit rule for that executable in the sudo config, so I am not really sure that is a valid reason), but the system does report the error if I supply a correct password.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.