2

I have a perl script that I fork from another script that I launch from a web browser via mod_perl. The forked script (which ends up running as apache) needs to sudo service X stop as part of a backup restore process: the X service depends on the restore. I had this running OK on Windows, but now porting to CentOS I'm running into the error in the title.

Setup:

  1. sudoers file has commented out # Defaults requiretty
  2. sudoers file has apache_usr localhost=(root) NOPASSWD: /sbin/service X stop (which passes a visudo -c check) and has no other apache_usr lines

Things I've tried:

  1. sudo /sbin/service instead of just sudo service in the forked process
  2. sudoers file with or without commenting out Defaults !visiblepw
  3. sudoers file with (ALL) instead of (root) in the NOPASSWD line above

What else is there to try?

5

In short it's how sudo was designed. See here.

It does host lookups a bit differently so as not to lag when you don't have a network connection / fast DNS server.

If you machine name is 'salt' then your proper sudoers line is:

apache_usr salt=(root) NOPASSWD: /sbin/service X stop

In other words, localhost is not a valid host name as far as sudoers is concerned.

2

You mentioned that "sudoers file has commented out # Defaults requiretty".

This won't have any effect if your build of sudo has requiretty on by default, which mine does. Use a targeted default spec for the user concerned:

Defaults:apache_usr !requiretty
0

When I write ALL=(root) instead, it works. Despite the fact that the script is running on the same server as the service I'm trying to stop. It's accessed in the browser via a different IP than the main one, but nonetheless, if I run ping -c 1 localhost I get 127.0.0.1 so I'm really curious as to why this change needed to be made.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.