topic Re: Bizarre sudo problem in Operating System - HP-UX

Bizarre sudo problem

Bob Bean — Wed, 08 Sep 2004 13:47:23 GMT

I've installed sudo1.6.7 onto an NClass running HP-UX 11.0.
I have a user who needs to be able to do 'kill' and mflmman.
Here are my sudoers entries:
# User alias specification
User_Alias OPERATOR = operator

# Cmnd alias specification
Cmnd_Alias KILL = /usr/bin/kill
Cmnd_Alias MFLMMAN = /opt/cobol/mflmf/mflmman

# Defaults specification

# User privilege specification
root ALL=(ALL) ALL
OPERATOR ALL = NOPASSWD: KILL,MFLMMAN

Kill works fine, and does not prompt for a password.
mflmman asks for a password, and after I enter it, I see the following:
HP Operator> sudo mflmman
Password:
sudo: mflmman: command not found
Sep 8 14:41:35 hpnclass sudo: operator : command not allowed ; TTY=pts/ts ; PWD
=/home/mis/operator ; USER=root ; COMMAND=mflmman

The mflmman command actually calls mflm_manager. Please see below:
#!/bin/sh
COBDIR=`pwd`
export COBDIR
LIBPATH=$COBDIR/lib:/lib:$LIBPATH
export LIBPATH
LD_LIBRARY_PATH=$COBDIR/lib:/lib:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH
SHLIB_PATH=$COBDIR/lib:/lib:$SHLIB_PATH
export SHLIB_PATH

./mflm_manager $*

No matter what I try, I cannot get this to work. Any ideas/hints would be most sincerely appreciated.

Thanks-
Stacey

Re: Bizarre sudo problem

Sundar_7 — Wed, 08 Sep 2004 13:52:19 GMT

The command the operator uses should exactly match that of in the /etc/sudoers file

Try this

Operator> sudo /opt/cobol/mflmf/mflmman
Password:

This should work

Re: Bizarre sudo problem

Craig Rants — Wed, 08 Sep 2004 15:01:14 GMT

Yes, I agree with Sundar

GL,
C

Re: Bizarre sudo problem

Sanjay_6 — Wed, 08 Sep 2004 15:21:45 GMT

Hi,

Try

# User alias specification

# Cmnd alias specification
/usr/bin/kill, /opt/cobol/mflmf/mflmman

# Defaults specification

# User privilege specification
root ALL=(ALL) ALL
operator ALL = (ALL) NOPASSWD :/usr/bin/kill, /opt/cobol/mflmf/mflmman

Hope this helps.

Regds

Re: Bizarre sudo problem

Stacey Akerstrom — Thu, 09 Sep 2004 09:14:17 GMT

When I add the following as suggested, I get a syntax error:
# Cmnd alias specification
#Cmnd_Alias KILL = /usr/bin/kill
#Cmnd_Alias MFLMMAN = /opt/cobol/mflmf/mflmman
Cmnd_Alias /usr/bin/kill, /opt/cobol/mflmf/mflmman

# Defaults specification

# User privilege specification
root ALL=(ALL) ALL
#OPERATOR ALL = NOPASSWD: KILL,MFLMMAN
OPERATOR ALL = (ALL) NOPASSWD :/usr/bin/kill, /opt/cobol/mflmf/mflmman

Thanks-
Stacey

Re: Bizarre sudo problem

Bob Bean — Fri, 10 Sep 2004 07:42:30 GMT

Any other suggestions on this one?

Thanks!
Stacey

Re: Bizarre sudo problem

Victor BERRIDGE — Fri, 10 Sep 2004 07:51:05 GMT

Hi,
Just thought..
You want him to have root permissions when it executes?
sudo -u root

All the best
Victor

Re: Bizarre sudo problem

Sridhar Bhaskarla — Fri, 10 Sep 2004 08:23:43 GMT

HI Stacey,

For it looks like

sudo /opt/cobol/mflmf/mflmman $*

should work.

What error are you getting?.

-Sri

Re: Bizarre sudo problem

Sanjay_6 — Fri, 10 Sep 2004 08:30:36 GMT

Hi Stacey,

I'm sorry, but my suggestion was,

# User alias specification

# Cmnd alias specification
# /usr/bin/kill, /opt/cobol/mflmf/mflmman

# Defaults specification

# User privilege specification
root ALL=(ALL) ALL
operator ALL = (ALL) NOPASSWD :/usr/bin/kill, /opt/cobol/mflmf/mflmman

Hope this helps.

Regds

Re: Bizarre sudo problem

Bob Bean — Fri, 10 Sep 2004 09:12:17 GMT

Hi Victor-
Thanks for replying.
I'm still getting the following:
HP Operator> sudo -l
User operator may run the following commands on this host:
(root) NOPASSWD: /usr/bin/kill
(root) NOPASSWD: /opt/cobol/mflmf/mflmman
HP Operator> sudo -u root mflmman
Password:
sudo: mflmman: command not found
Sep 10 10:08:28 hpnclass sudo: operator : command not allowed ; TTY=pts/tC ; PWD
=/home/mis/operator ; USER=root ; COMMAND=mflmman

Re: Bizarre sudo problem

Sridhar Bhaskarla — Fri, 10 Sep 2004 09:47:40 GMT

Bob/Stacey,

The problem with not specifying the full patch to mflmman is that it will be searched under sudo's default search path which is a compiler option. Hence, it can't find it.

So, no matter what you do, simply specifying mflmman will not work. However, copy it to /usr/bin and then it should work as normallly /usr/bin is one of the standard directories in SUDO's path.

-Sri

Re: Bizarre sudo problem

Bob Bean — Fri, 10 Sep 2004 09:53:05 GMT

Even with the following present in sudoers:
# User privilege specification
root ALL=(ALL) ALL
operator ALL = (ALL) NOPASSWD :/usr/bin/kill, /opt/cobol/mflmf/mflmman

I get:
HP Operator> sudo /opt/cobol/mflmf/mflmman
/opt/cobol/mflmf/mflmman[11]: ./mflm_manager: not found.

So it's can't find mglm_manager?

Re: Bizarre sudo problem

Bob Bean — Fri, 10 Sep 2004 09:55:39 GMT

Sridhar-
Just so I understand this, are you saying I should cp mflmman over to /usr/sbin?
Thanks-
Stacey

Re: Bizarre sudo problem

Bob Bean — Fri, 10 Sep 2004 09:56:29 GMT

Oops, I meant /usr/bin, of course.

Stacey

Re: Bizarre sudo problem

Sridhar Bhaskarla — Fri, 10 Sep 2004 10:02:05 GMT

Yep.. also there is a problem in the script. You will have to be in the COBDIR (COBDIR=`pwd`) in order to get it working..
I suggest you change the script to

COBDIR="/wherever/it/is"
..
..
$COBDIR/mflm_manager $*

-Sri

Re: Bizarre sudo problem

Victor BERRIDGE — Mon, 16 Sep 2024 09:08:09 GMT

Hi Bob,
This is how I solved the problem here:
the account here that can use the command is exploit... In sudoers:
exploit ALL=(OP) NOPASSWD : /sm/bin/mflm
Now the content of /sm/bin/mflm
#!/sbin/sh
#---------------------------------------------------------------------------#
# Start the MFLM License Manager (VBE - 02.12.05)
# export COBDIR=/opt/cobol/mflmf
# export SHLIB_PATH=$COBDIR/coblib:$SHLIB_PATH:/lib
# cd /opt/cobol/mflmf
# ./mflm_manager
#---------------------------------------------------------------------------#
export PATH=/usr/sbin:/usr/bin:/sbin
rval=0

case "$1" in
start_msg)
echo "Start MFLM License Manager"
;;
stop_msg)
echo "Stop MFLM License Manager"
;;
start)
/etc/mflmrcscript 2>&1
;;
stop)
for i in $(ps -ef|grep -i mflm_manager|grep -v grep|awk '{print $2}')
do
kill -9 $i
done
;;
*)
echo "usage: $0 {start|stop}"
rval=1
;;
esac
#

And the /etc/mflm_manager script
# more mflmrcscript
echo Starting MFLM License Manager
COBDIR=/opt/cobol/mflmf
export COBDIR
SHLIB_PATH=$COBDIR/coblib:$SHLIB_PATH:/lib
export SHLIB_PATH
cd /opt/cobol/mflmf
./mflm_manager

Hope this helps a little

All the best
Victor