topic Re: sudo question in Operating System - HP-UX

sudo question

Tom Wolf_3 — Thu, 04 Jun 2009 00:36:30 GMT

Hello all.
On one of our HP-UX 11.11 servers I have sudo configured to allow user joe to execute script /opt/submit as user ivan.

User joe executes the following command as himself and enters his password when prompted.

$ sudo -u ivan /opt/submit

The /opt/submit script requires ivan's environment variables to execute properly but when joe executes this command it's using his environment variables and not ivan's.

How would I address this?

By the way we're running sudo version 1.6.3.

Thanks in advance.

Re: sudo question

Jeeshan — Thu, 04 Jun 2009 02:13:24 GMT

then you might have to be set ivan's variable to joe and then try to execute.

Re: sudo question

George Spencer_4 — Thu, 04 Jun 2009 03:17:00 GMT

How about:

sudo -u ivan ". ~ivan/.profile; /opt/submit"

but you will have to change the sudoers file.

or

sudo su - ivan /opt/submit

Re: sudo question

johnsonpk — Thu, 04 Jun 2009 04:11:40 GMT

Hi Tom,

You can try this ,

#sudo -i -u ivan /opt/submit

Rgds
Johnson

Re: sudo question

Patrick Wallek — Thu, 04 Jun 2009 04:28:47 GMT

The easier thing would be to set the required environment variables inside the /opt/submit script.

If a script requires a specific environment, set it in the script. Never trust that the users environment will be correct. By setting the environment in the script, you KNOW it will always be correct.

Re: sudo question

Sajjad Sahir — Thu, 04 Jun 2009 05:16:37 GMT

Dear Tom

Please list of who can run what

/etc/sudoers

thanks and regards

Sajjad Sahir

Re: sudo question

F Verschuren — Fri, 05 Jun 2009 06:44:36 GMT

to go throu the profile use:
sudo su - ivan -c "/opt/submit"

do gain this acces you need to change the sudo config:
joe ALL=(ALL) PASSWD:/usr/bin/su - ivan -c /opt/submit

Re: sudo question

Ralph Grothe — Fri, 05 Jun 2009 09:16:00 GMT

Hi Tom,

I guess that you could also set the Defaults for user joe by setting env_keep in sudoers and listing which of joe's environment variables which would otherwise be unset (apart from LOGNAME, HOME etc. even when invoked as "sudo -i -u joe /opt/submit".

Though I haven't tried it, it might work.
As root run visudo.
Then add this to your sudoers:

Defaults:joe env_keep="JOES_ENV_VAR1 JOES_ENV_VAR2...JOES_ENV_VARN"

Substitute JOES_ENV_VAR? above by those variables of joe's login environment that you wish to be preserved. The variables in the double quotes need to be delimited by whitespace.

Re: sudo question

Ralph Grothe — Fri, 05 Jun 2009 09:21:08 GMT

Sorry, I mixed up joe and ivan in your example.
But I guess you can gather how it's meant.
Also the line break of my Deafults line shouldn't appear in the sudoers file. this was only caused by the webserver after having submitted my reply.

Re: sudo question

Tom Wolf_3 — Fri, 05 Jun 2009 19:01:31 GMT

Thanks to all who replied.
We upgraded sudo from version 1.6.3 (which didn't have the "-i" option - simulate initial login) to version 1.7.1 (which does have the "-i" option). We also had to add the korn shell /usr/bin/ksh to /etc/sudoers.

Once that was done, user joe could execute the /opt/submit script as ivan with ivan's environment variables by running the following:

$ sudo -i -u ivan /opt/submit

Thanks again for the help.

Re: sudo question

Tom Wolf_3 — Fri, 05 Jun 2009 19:02:20 GMT

Forum guru's suggestions did the trick!