Sudo: Difference between revisions
m Text replacement - "<code>" to "{{code|" |
m Text replacement - "</code>" to "}}" |
||
| Line 1: | Line 1: | ||
== Overview == | == Overview == | ||
In a nutshell, sudo permissions are defined in {{code|/etc/sudoers | In a nutshell, sudo permissions are defined in {{code|/etc/sudoers}} and {{code|/etc/sudoers.d/}}. Permissions are defined like so: | ||
%groupname workstation=/bin/command | %groupname workstation=/bin/command | ||
| Line 7: | Line 7: | ||
username workstation=(run-as user) /bin/command | username workstation=(run-as user) /bin/command | ||
Replace any of the above with {{code|ALL | Replace any of the above with {{code|ALL}} to have it match anyone. eg: | ||
ALL ALL=ALL | ALL ALL=ALL | ||
You can use {{code|NOPASSWD: /bin/command | You can use {{code|NOPASSWD: /bin/command}} to have it not prompt for the user's password. | ||
You can verify whether your changes worked by listing sudo access: | You can verify whether your changes worked by listing sudo access: | ||
| Line 19: | Line 19: | ||
== Configure sudo to include /etc/sudoers.d/ == | == Configure sudo to include /etc/sudoers.d/ == | ||
For the configs in {{code|/etc/sudoers.d/ | For the configs in {{code|/etc/sudoers.d/}} to work, you must place an existing file with perms set to 0440 into {{code|/etc/sudoers.d/}}. | ||
'''You cannot create the file directly in {{code|/etc/sudoers.d/ | '''You cannot create the file directly in {{code|/etc/sudoers.d/}}''' because it will not work! | ||
Also ensure the {{code|#includedir | Also ensure the {{code|#includedir}} directive is defined in {{code|/etc/sudoers}}. | ||
== Troubleshooting == | == Troubleshooting == | ||
| Line 33: | Line 33: | ||
Defaults ! requiretty | Defaults ! requiretty | ||
If you want to run a command as another user, you could also try {{code|su | If you want to run a command as another user, you could also try {{code|su}}. For example: | ||
su user -c 'whoami' | su user -c 'whoami' | ||
Revision as of 19:14, 24 February 2017
Overview
In a nutshell, sudo permissions are defined in /etc/sudoers and /etc/sudoers.d/. Permissions are defined like so:
%groupname workstation=/bin/command username workstation=/bin/command username workstation=(run-as user) /bin/command
Replace any of the above with ALL to have it match anyone. eg:
ALL ALL=ALL
You can use NOPASSWD: /bin/command to have it not prompt for the user's password.
You can verify whether your changes worked by listing sudo access:
sudo -l
Configure sudo to include /etc/sudoers.d/
For the configs in /etc/sudoers.d/ to work, you must place an existing file with perms set to 0440 into /etc/sudoers.d/.
You cannot create the file directly in /etc/sudoers.d/ because it will not work!
Also ensure the #includedir directive is defined in /etc/sudoers.
Troubleshooting
sudo: sorry, you must have a tty to run sudo
Ensure that you do not require tty. Either comment out or use !requiretty .
# cat /etc/sudoers Defaults ! requiretty
If you want to run a command as another user, you could also try su. For example:
su user -c 'whoami'
sudo: no tty present and no askpass program specified
make sure you have NOPASSWD set in your sudoers file. eg:
<USER> <host>=NOPASSWD:<command>