SUDO help

[Sajjad Ali_1]

Hi,

I am looking for some help with sudo. I have a script process.sh owned by user TESTA and permission 744. process.sh needs TESTA's environment variables set in .profile for successful run.

I've configured SUDO, so that user TESTB can run process.sh and pick up environment settings of TESTA. But it's not picking up the env variables, in other words, it's not executing TESTA's profile at runtime. How can I make it execute the profile before running the script? I am running this as TESTB: sudo -u TESTA /home/TESTA/process.sh

Host_Alias SVR = HP1
User_Alias ADMIN = TESTB
Cmnd_Alias SCRIPTS = /home/TESTA/process.sh

ADMIN SVR = (TESTA) SCRIPTS

Thanks for your help in advance.

SA

[RAC_1]

sudo wont run the .profile of that user. you will have to define all required variables in process.sh.

Anil

[Sajjad Ali_1]

Okay, Thanks Anil,
One more question about SUDO. How do I allow certain users to SU to only prod1 user but not anyone else?

Host_Alias SVR = HP1
User_Alias ADMIN = joe
Cmnd_Alias SU= /usr/bin/su

ADMIN SVR = (prod1) SU, !root (is this the right systax?)

Thanks again.

[Patrick Wallek]

I would set up the specific su command that they are allowed to use.

Cmnd_Alias SUPROD1=/usr/bin/su - prod1

Then for the user:

ADMIN SVR=SUPROD1

This way if the user enters something other than the above command, they will get an error. If you just have a few su's that you need to allow, this is relatively easy.

[Sajjad Ali_1]

One additional question, would that SUDO policy work if I remove the setuid from /usr/bin/su or make it only executable by root? How do I allow only the ADMIN group to be able to su to root without password? Thanks again.

[Jannik]

but the su command will.. try this:
sudo su - TESTA -c '/home/TESTA/process.sh'

[Mark Nieuwboer]

Sajjad,

When you put su- in sudo you are wasting sudo. When persons needs to su - to another user let them fill in the password of the user.