0

I'm trying to set sudoers properly in a way that my user can poweroff or reboot the system without needing to prompt for password. I did this in several systems but for some reason it's not working for me Debian 10 Buster.

I tried everything I could come up with: Putting NOPASSWD in the default %sudo group, putting it instead in my user directly, putting it as an alias, and even, putting the several paths for command reboot, poweroff and shutdown, but nothing works.

Without further ado, I'll show my sudoers file in order to shed some light about this:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification
Cmnd_Alias SHUTDOWN=/sbin/poweroff, /sbin/reboot, /sbin/shutdown, /usr/sbin/reboot, /usr/sbin/poweroff, /usr/sbin/shutdown

# User privilege specification
root    ALL=(ALL:ALL) ALL
aren    ALL=NOPASSWD: SHUTDOWN

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Note: I edit this file with visudo, never with an editor directly and visudo does not complain about any misconfiguration or syntax error or whatever mistake that visudo often says.

Any ideas? Do you see anything wrong? Thank you so much beforehand.

Improve this question
2
  • Check this.
    – Kamil Maciorowski
    Aug 18, 2020 at 10:04
  • Yup, it was the order, thank you so much. But then, how would it do it in on line only? That is, if I wanted to include it in the sudo group? Because I tried this and does not work: %sudo ALL=(ALL:ALL) NOPASSWD: SHUTDOWN, PASSWD: ALL
    – Alex López
    Aug 18, 2020 at 12:12

1 Answer 1

Reset to default
0

Update: I fixed it thanks to @KamilMaciorowski and I figured out the one-line solution, so for those wanting to do it in one line, it'd be like this:

%sudo   ALL=(ALL)       PASSWD: ALL, NOPASSWD: </path/to/commands here>

Instead of: %sudo ALL=(ALL) NOPASSWD: </path/to/commands here>, PASSWD: ALL

Because it "prevails" the last thing you put.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .