cancel
Showing results for 
Search instead for 
Did you mean: 

sudo question

 
Tom Wolf_3
Valued Contributor

sudo question

Hello all.
On one of our HP-UX 11.11 servers I have sudo configured to allow user joe to execute script /opt/submit as user ivan.

User joe executes the following command as himself and enters his password when prompted.


$ sudo -u ivan /opt/submit

The /opt/submit script requires ivan's environment variables to execute properly but when joe executes this command it's using his environment variables and not ivan's.

How would I address this?

By the way we're running sudo version 1.6.3.

Thanks in advance.


10 REPLIES
Jeeshan
Honored Contributor

Re: sudo question

then you might have to be set ivan's variable to joe and then try to execute.
a warrior never quits
George Spencer_4
Frequent Advisor

Re: sudo question

How about:

sudo -u ivan ". ~ivan/.profile; /opt/submit"

but you will have to change the sudoers file.

or

sudo su - ivan /opt/submit
johnsonpk
Honored Contributor

Re: sudo question

Hi Tom,

You can try this ,

#sudo -i -u ivan /opt/submit

Rgds
Johnson

Patrick Wallek
Honored Contributor

Re: sudo question

The easier thing would be to set the required environment variables inside the /opt/submit script.

If a script requires a specific environment, set it in the script. Never trust that the users environment will be correct. By setting the environment in the script, you KNOW it will always be correct.
Sajjad Sahir
Honored Contributor

Re: sudo question

Dear Tom

Please list of who can run what

/etc/sudoers

thanks and regards

Sajjad Sahir
F Verschuren
Esteemed Contributor

Re: sudo question

to go throu the profile use:
sudo su - ivan -c "/opt/submit"

do gain this acces you need to change the sudo config:
joe ALL=(ALL) PASSWD:/usr/bin/su - ivan -c /opt/submit
Ralph Grothe
Honored Contributor

Re: sudo question

Hi Tom,

I guess that you could also set the Defaults for user joe by setting env_keep in sudoers and listing which of joe's environment variables which would otherwise be unset (apart from LOGNAME, HOME etc. even when invoked as "sudo -i -u joe /opt/submit".

Though I haven't tried it, it might work.
As root run visudo.
Then add this to your sudoers:

Defaults:joe env_keep="JOES_ENV_VAR1 JOES_ENV_VAR2...JOES_ENV_VARN"

Substitute JOES_ENV_VAR? above by those variables of joe's login environment that you wish to be preserved. The variables in the double quotes need to be delimited by whitespace.


Madness, thy name is system administration
Ralph Grothe
Honored Contributor

Re: sudo question

Sorry, I mixed up joe and ivan in your example.
But I guess you can gather how it's meant.
Also the line break of my Deafults line shouldn't appear in the sudoers file. this was only caused by the webserver after having submitted my reply.
Madness, thy name is system administration
Tom Wolf_3
Valued Contributor

Re: sudo question

Thanks to all who replied.
We upgraded sudo from version 1.6.3 (which didn't have the "-i" option - simulate initial login) to version 1.7.1 (which does have the "-i" option). We also had to add the korn shell /usr/bin/ksh to /etc/sudoers.

Once that was done, user joe could execute the /opt/submit script as ivan with ivan's environment variables by running the following:

$ sudo -i -u ivan /opt/submit

Thanks again for the help.
Tom Wolf_3
Valued Contributor

Re: sudo question

Forum guru's suggestions did the trick!