49

I want to disable requiretty so that I can sudo within scripts, but I'd rather only disable it for a single command rather than everything. Is that possible within the sudoers config?

3 Answers 3

60

You can override the default setting for options such as requiretty for a specific user or for a specific command (or for a specific run-as-user or host), but not for a specific command when executed as a specific user.

For example, assuming that requiretty is set in the compile-default options, the following sudoers file allows both artbristol and bob to execute /path/to/program as root from a script. artbristol needs no password whereas bob must have to enter a password (presumably tty_tickets is off and bob entered his password on some terminal recently).

artbristol ALL = (root) NOPASSWD: /path/to/program
bob ALL = (root) /path/to/program
Defaults!/path/to/program !requiretty

If you want to change the setting for a command with specific arguments, you need to use a command alias (this is a syntax limitation). For example, the following fragment allows artbristol to run /path/to/program --option in a script, but not /path/to/program with other arguments.

Cmnd_Alias MYPROGRAM = /path/to/program --option  
artbristol ALL = (root) /path/to/program
artbristol ALL = (root) NOPASSWD: MYPROGRAM
Defaults!MYPROGRAM !requiretty
2
  • The one with the argument might need a wildcard in the end as well(?): If a Cmnd has associated command line arguments, then the arguments in the Cmnd must match exactly those given by the user on the command line (or match the wildcards if there are any).
    – aderchox
    Nov 29, 2021 at 8:10
  • 1
    @aderchox The point of my example was to show how to allow only a specific argument list. Nov 29, 2021 at 8:54
35

Something like this:

myuser    ALL=(ALL)    NOPASSWD:/usr/local/bin/mycmd
Defaults:myuser        !requiretty
3
  • This might work in /etc/sudoers but does not appear to work in a /etc/sudoers.d/ file
    – 8bitjunkie
    Nov 14, 2015 at 0:33
  • For what it's worth, for me, this edit did work when added to a /etc/sudoers.d/ file. CentOS 7.1
    – John Erck
    Aug 5, 2016 at 16:17
  • It doesn't work for me when using /etc/sudoers.d/. CentOS 7.5 :( Sep 15, 2018 at 0:02
4

I found it works fine for me using a file in /etc/sudoers.d. It is quite simple to verify.

First, I created /etc/sudoers.d/01build with the contents:

build    ALL=(ALL)    NOPASSWD:/bin/date
Defaults:build !requiretty

Then tested that it works:

ssh host sudo -n /bin/date
Mon Nov 16 16:04:27 CST 2015

Then I modified /etc/sudoers.d/01build and deleted the Defaults: line, and after that, I get:

ssh host sudo -n /bin/date
sudo: sorry, you must have a tty to run sudo

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.