topic Re: Sudo Password Problems in Operating System - HP-UX

Sudo Password Problems

CRollins — Wed, 19 Sep 2007 07:00:20 GMT

I'm configuring the sudo file user specification. When issuing the command, it's still prompting for a password. The username is an alias and the command string is an alias.

USERNAMEGROUP ALL=(user2) NOPASSWD: COMMANDVAR

Re: Sudo Password Problems

Matti_Kurkela — Wed, 19 Sep 2007 07:36:50 GMT

Have you specified the actual full path of the command in the COMMANDVAR alias definition?

Sudo is very, very picky about the commands it allows. If your COMMANDVAR is specified like this:

Cmnd_Alias COMMANDVAR = ls

it won't work.

You must specify something like

Cmnd_Alias COMMANDVAR = /bin/ls

instead.

This behaviour is by design: it ensures the user cannot use commands the sysadmin did not intend by playing tricks with his/her PATH environment variable.

And what's the exact sudo command line you're trying? It should be something like

sudo -u user2

If the "-u user2" option is not specified, sudo will assume "-u root" by default... which of course does not match your rule.

MK

Re: Sudo Password Problems

Steven E. Protter — Wed, 19 Sep 2007 07:37:46 GMT

Shalom,

Form:

sudo program-name

Any other form will prompt for a password.

Check that you are not using reserved words in your sudoers configuration.

SEP

Re: Sudo Password Problems

CRollins — Wed, 19 Sep 2007 07:48:15 GMT

the full path is there. there are two executables with the full path delimited by a comma and then a space. does spacing matter in the syntax?

the command line string

sudo -u user2 command

Re: Sudo Password Problems

CRollins — Wed, 19 Sep 2007 07:59:25 GMT

USERNAMEGROUP ALL=(user2) NOPASSWD: COMMANDVAR

where USERNAMEGROUP is a User_Alias in the syntax:
User_Alias USERNAMEGROUP=USER
where USER above is also in caps (as in /etc/passwd)

where (user2) is a Runas_Alias in the form USER2=user2 and is in caps in the user specification.

where COMMANDVAR is a Cmnd_Alias in the form
Cmnd_Alias COMMANDVAR=/path/executable,/path/executable

Re: Sudo Password Problems

Matti_Kurkela — Wed, 19 Sep 2007 07:59:50 GMT

Try running "sudo -l" as an user that belongs to the USERNAMEGROUP. It may ask for a password, but it should then list the commands the user is allowed to run using sudo (unless the configuration options prevent the listing).

Does the output look correct?

MK

Re: Sudo Password Problems

CRollins — Wed, 19 Sep 2007 08:02:40 GMT

yep

(user2) NOPASSWD: /path/executable, /path/executable

Re: Sudo Password Problems

CRollins — Wed, 19 Sep 2007 08:04:00 GMT

if i execute it as follows, then how am i sure its running it as the other user?

sudo program-name

Re: Sudo Password Problems

Reidmeister — Thu, 20 Sep 2007 03:31:21 GMT

the user must type the -u when you are specifying a command to be run under a specific account

/usr/local/bin/sudo -u 'username' 'command_exactly_as_referencec_in_sudoers'