Sudo: Difference between revisions

From Leo's Notes
This page was last edited on 15 June 2020, at 01:58.
← Older edit
VisualWikitext
No edit summary
mNo edit summary
 
(18 intermediate revisions by 2 users not shown)
Line 1: Line 1:


In a nutshell, sudo permissions are defined in <code>/etc/sudoers</code> and <code>/etc/sudoers.d/</code>. Permissions are defined like so:
== Overview ==
In a nutshell, sudo permissions are defined in {{code|/etc/sudoers}} and {{code|/etc/sudoers.d/}}. Permissions are defined like so:


%groupname workstation=/bin/command
{{highlight|lang=text|code=
username workstation=/bin/command
%groupname workstation=/bin/command
username workstation=(run-as user) /bin/command
username workstation=/bin/command
username workstation=(run-as user) /bin/command
}}


Replace any of the above with <code>ALL</code> to have it match anyone. eg:
Replace any of the above with {{code|ALL}} to have it match anyone. eg:


ALL ALL=ALL
{{highlight|lang=text|code=
ALL ALL=ALL
}}


You can use <code>NOPASSWD: /bin/command</code> to have it not prompt for the user's password.
You can use {{code|NOPASSWD: /bin/command}} to have it not prompt for the user's password.


You can verify whether your changes worked by listing sudo access:
You can verify whether your changes worked by listing sudo access:
sudo -l


{{highlight|lang=terminal|code=
# sudo -l
}}


== Configure using /etc/sudoers.d/ ==
== Configure sudo to include /etc/sudoers.d/ ==
Additional sudo configs can be placed in {{code|/etc/sudoers.d/}}. Files placed here must have the permissions set to 0440.


For the configs in <code>/etc/sudoers.d/</code> to work, you must place an existing file with perms set to 0440 into <code>/etc/sudoers.d/</code>.
For example:
{{highlight|lang=terminal|code=
# cd /etc/sudoers.d
# echo "gandalf ALL=(root) NOPASSWD: /usr/sbin/dmidecode" > run_dmidecode
# chmod 0440 run_dmidecode
}}


'''You cannot create the file directly in <code>/etc/sudoers.d/</code>''' because it will not work!
Ensure the {{code|#includedir}} directive is defined in {{code|/etc/sudoers}}. This is disabled by default on some distributions and none of the config files there will be loaded.


Also ensure the <code>#includedir</code> directive is defined in <code>/etc/sudoers</code>.
== Regular Expression Matching ==
Sudoers does not support regular expression matching. It only supports glob expansion, which only works for file names and paths.
 
If regular expression is absolutely necessary, use a wrapper script instead.
 
For example, this script will only allow 'yum install' to run on package names matching a particular regex and not packages that are local files.
{{highlight|lang=bash|filename=/bin/yum-wrapper.sh|code=
<nowiki>
#!/bin/bash
 
if [ -f "$1" ] ; then
        echo "Error: Cannot install local package file."
        exit
fi
 
if  ! [[ "$1" =~ ^[a-zA-Z0-9._-]+$ ]] ; then
        echo "Error: Invaild package name."
        exit
fi
 
yum install "$1"
</nowiki>
}}
 
The sudoers file would look something like this:
{{highlight|lang=text|code=
sa-lleung@uc.ucalgary.ca ALL=(root) NOPASSWD: /bin/yum-wrapper.sh
}}
 
The script could be made a bit smarter to allow multiple argument parsing.


== Troubleshooting ==
== Troubleshooting ==


=== sudo: sorry, you must have a tty to run sudo ===
=== sudo: sorry, you must have a tty to run sudo ===
If you get the error while trying to run {{code|sudo}} through a script or a non-interactive shell:
{{highlight|lang=text|code=
sudo: sorry, you must have a tty to run sudo
}}


Ensure that you do not require tty. Either comment out or use !requiretty .
Ensure that you do not require a TTY in your {{code|/etc/sudoers}} configuration. Either comment out or use {{code|!requiretty}}.
# cat /etc/sudoers
{{highlight|lang=text|code=
Defaults  ! requiretty
## In /etc/sudoers
## From
Defaults  requiretty


## To one of:
Defaults    !requiretty
# Defaults  requiretty
}}
'''A one-liner to fix this:'''
{{highlight|lang=terminal|code=
# sed -i s'/Defaults requiretty/#Defaults requiretty'/g /etc/sudoers
}}
As a side note, if you just want to run a command as another user, you could also try {{code|su}} instead. For example:
{{highlight|lang=terminal|code=
# su $username -c 'whoami'
}}


=== sudo: no tty present and no askpass program specified ===
=== sudo: no tty present and no askpass program specified ===
If you get {{highlight|lang=text|code=
sudo: no tty present and no askpass program specified
}}
Make sure you have {{code|NOPASSWD}} set in your {{code|/etc/sudoers}} file.


make sure you have NOPASSWD set in your sudoers file.
Eg. The files should have a line like:
eg:
{{highlight|lang=text|code=
  <USER> <host>=NOPASSWD:<command>
<USER> <host>=NOPASSWD:<command>
}}




[[Category:Linux]]
{{Navbox Linux}}[[Category:Linux]]
[[Category:LinuxUtilities]]

Latest revision as of 01:58, 15 June 2020

Overview

In a nutshell, sudo permissions are defined in /etc/sudoers and /etc/sudoers.d/. Permissions are defined like so: 

%groupname workstation=/bin/command
username workstation=/bin/command
username workstation=(run-as user) /bin/command

Replace any of the above with ALL to have it match anyone. eg: 

ALL ALL=ALL

You can use NOPASSWD: /bin/command to have it not prompt for the user's password.

You can verify whether your changes worked by listing sudo access: 

# sudo -l

Configure sudo to include /etc/sudoers.d/

Additional sudo configs can be placed in /etc/sudoers.d/. Files placed here must have the permissions set to 0440.

For example: 

# cd /etc/sudoers.d
# echo "gandalf ALL=(root) NOPASSWD: /usr/sbin/dmidecode" > run_dmidecode
# chmod 0440 run_dmidecode

Ensure the #includedir directive is defined in /etc/sudoers. This is disabled by default on some distributions and none of the config files there will be loaded.

Regular Expression Matching

Sudoers does not support regular expression matching. It only supports glob expansion, which only works for file names and paths.

If regular expression is absolutely necessary, use a wrapper script instead.

For example, this script will only allow 'yum install' to run on package names matching a particular regex and not packages that are local files. 

#!/bin/bash

if [ -f "$1" ] ; then
        echo "Error: Cannot install local package file."
        exit
fi

if  ! [[ "$1" =~ ^[a-zA-Z0-9._-]+$ ]] ; then
        echo "Error: Invaild package name."
        exit
fi

yum install "$1"

The sudoers file would look something like this: 

sa-lleung@uc.ucalgary.ca ALL=(root) NOPASSWD: /bin/yum-wrapper.sh

The script could be made a bit smarter to allow multiple argument parsing.

Troubleshooting

sudo: sorry, you must have a tty to run sudo

If you get the error while trying to run sudo through a script or a non-interactive shell: 

sudo: sorry, you must have a tty to run sudo

Ensure that you do not require a TTY in your /etc/sudoers configuration. Either comment out or use !requiretty. 

## In /etc/sudoers
## From 
Defaults   requiretty

## To one of:
Defaults     !requiretty
# Defaults   requiretty

A one-liner to fix this: 

# sed -i s'/Defaults requiretty/#Defaults requiretty'/g /etc/sudoers

As a side note, if you just want to run a command as another user, you could also try su instead. For example: 

# su $username -c 'whoami'

sudo: no tty present and no askpass program specified

If you get 

sudo: no tty present and no askpass program specified

Make sure you have NOPASSWD set in your /etc/sudoers file.

Eg. The files should have a line like: 

<USER> <host>=NOPASSWD:<command>


Various Linux Notes
Linux Tools and Utilites
Package Management
Linux Distributions
Networking
Containers