topic sudo NOPASSWD issue in Operating System - Linux

sudo NOPASSWD issue

MikeL_4 — Wed, 25 Nov 2009 13:49:58 GMT

I am running Red Hat 5.3 and have coded sudo for a user to execute some commands with the NOPASSWD option...

infort1 ALL=(ALL) NOPASSWD: /infinys/network/orl/working/APS/ClusterScripts/stopCluster.ksh /infinys/network/orl/working/APS/ClusterScripts/startCluster.ksh /infinys/network/orl/working/APS/ClusterScripts/manageClusterNode.ksh /infinys/network/orl/working/APS/ClusterScripts/cleanCluster.ksh /infinys/network/orl/working/APS/ClusterScripts/checkCluster.ksh

A sudo -l shows the correct setting that I added:
-> sudo -l
User infort1 may run the following commands on this host:
(ALL) NOPASSWD: /infinys/network/orl/working/APS/ClusterScripts/stopCluster.ksh /infinys/network/orl/working/APS/ClusterScripts/startCluster.ksh /infinys/network/orl/working/APS/ClusterScripts/manageClusterNode.ksh /infinys/network/orl/working/APS/ClusterScripts/cleanCluster.ksh /infinys/network/orl/working/APS/ClusterScripts/checkCluster.ksh
[cvoisaf01->/osg1/home/infort1]
->

However, when the infort1 user tries to execute the on of the scripts, it is still asking for the password:

-> sudo /infinys/network/orl/working/APS/ClusterScripts/checkCluster.ksh -c DISTCLUSTER -h /infinys/local/orl/HA
Password:
[cvoisaf01->/osg1/home/infort1]
->

Any ideas as to why this isn't working ??

Re: sudo NOPASSWD issue

Goran Koruga — Wed, 25 Nov 2009 14:11:46 GMT

Hi.

Shouldn't it be like so:

infort1 ALL = NOPASSWD: cmd1, cmd2, ...

Regards,
Goran

Re: sudo NOPASSWD issue

MikeL_4 — Wed, 25 Nov 2009 14:17:14 GMT

Do you know how long I've looked at this command line and could't get see it...

Changed to a "," after each command and it worked....

Thanks

Re: sudo NOPASSWD issue

Matti_Kurkela — Wed, 25 Nov 2009 14:18:06 GMT

You're missing a comma "," between each allowed command.

Currently your sudoers definition file means that infort1 may run the stopCluster.ksh script, if and only if he specifies the full pathnames of other scripts as command-line arguments. If even one character is out of place in the "mandatory arguments", the command is denied.

This would be the corrected version:

infort1 ALL=(ALL) NOPASSWD: /infinys/network/orl/working/APS/ClusterScripts/stopCluster.ksh, /infinys/network/orl/working/APS/ClusterScripts/startCluster.ksh, /infinys/network/orl/working/APS/ClusterScripts/manageClusterNode.ksh, /infinys/network/orl/working/APS/ClusterScripts/cleanCluster.ksh, /infinys/network/orl/working/APS/ClusterScripts/checkCluster.ksh

Even better would be to use "\" to split the sudoers definition to multiple lines to make it more readable:

infort1 ALL=(ALL) NOPASSWD: /infinys/network/orl/working/APS/ClusterScripts/stopCluster.ksh, \
/infinys/network/orl/working/APS/ClusterScripts/startCluster.ksh, \
/infinys/network/orl/working/APS/ClusterScripts/manageClusterNode.ksh, \
/infinys/network/orl/working/APS/ClusterScripts/cleanCluster.ksh, \
/infinys/network/orl/working/APS/ClusterScripts/checkCluster.ksh

MK