topic Re: Sudo giving problem in Operating System - HP-UX

Sudo giving problem

Jeeshan — Tue, 01 Dec 2009 07:39:38 GMT

OS: 11.23
Sudo version: 1.6.9p5.001

I have an application super user name “ops”, which has some environment variables. And all application binary is executable and owned by “ops” user. I want to create some individual user ID’s who are able to run “ops” binaries using his own environment variables.

But unfortunately, when I run “env“ command of the individual user’s its showing the variables as like as of the super user “ops”. But when I run command “env” using sudo, i.e. sudo –u ops env, it shows only the default variables.

But in my other servers (OS: 11iv1) it showing correctly.

Where would be the problem?

Re: Sudo giving problem

Matti_Kurkela — Tue, 01 Dec 2009 08:27:29 GMT

Because of various security exploits, newer versions of sudo will sanitize the environment variables when switching to another user by default. All environment variables that are not in a specific list of allowed variables are removed. By default, the list is very short indeed.

Older versions of sudo are less strict in this. If you want to know exactly when the change did happen, read the release history document of sudo.

With the new versions, you must explicitly list in the sudoers file the environment variables that your users are allowed to pass to the ops user. See "man sudoers" for more details.

The necessary sudoers configuration line would probably be something like this:

Defaults > ops env_keep+="VARIABLE_NAME1 VARIABLE_NAME2"

MK

Re: Sudo giving problem

Jeeshan — Wed, 02 Dec 2009 07:18:03 GMT

Thanks for your point.

Apart from this, I have a file contains huge number of Environment variables. It's troublesome job to put all environment variables as you said.

How can I configure sudoers with the specific environment variables files?

Re: Sudo giving problem

Dennis Handly — Wed, 02 Dec 2009 07:38:58 GMT

>MK: With the new versions, you must explicitly list in the sudoers file the environment variables that your users are allowed to pass to the ops user.

I thought there was an option to allow all variables to pass through?
We had one application stop working on the new sudo. We either had to use that option or better, pass that one variable on the command line.

Re: Sudo giving problem

Jeeshan — Wed, 02 Dec 2009 07:44:17 GMT

Hey Dennis, what was the option?

Can you clear that?

Re: Sudo giving problem

Dennis Handly — Wed, 02 Dec 2009 09:09:02 GMT

>what was the option?

See -E in the manual:
http://www.sudo.ws/sudo/man/sudo.html#options

It mentions:
It is only available when either the matching command has the SETENV tag or the setenv option

Re: Sudo giving problem

Jeeshan — Mon, 18 Jan 2010 04:28:05 GMT

yeah the -E option works.

But user is habituated with only sudo -u .

How can I use the above syntax without using -E?

Re: Sudo giving problem

johnsonpk — Mon, 18 Jan 2010 04:43:03 GMT

Hi Jeeshan,

Create an alias for sudo something like

alias sudo="sudo -E"

You need to put the above command in the proposed user's .profile to have it permanent over logins

Regards
Johnson

Re: Sudo giving problem

Jeeshan — Mon, 18 Jan 2010 08:56:30 GMT

Good replies!!!