sudo needs passwords?

[Terrence]

I just installed the lastest sudo and was attempting a test to give a non root user the ability to run the useradd command when it prompted me for a password. (It also lectured me) It didn't like the passwords I tried, (both the user's password, and the root password) and now it won't let me try again, it just says that user is not allowed to execute that command. I need sudo to let this user execute useradd without prompting for a password.

I'm digging into the documentation but if anyone can explain it first I'd appreciate it.

[Terrence]

Oh and yes I did set the sudoers file to nopassword. Here's my entry:

acountor server5=NOPASSWD:/usr/bin/finadd2,/usr/bin/useradd

[Vasikaran Venkatesan]

Should server5 be ALL ?
acountor ALL=NOPASSWD:/usr/bin/finadd2,/usr/bin/useradd

you can create a
Cmnd_Alias ACCOUNTER=/usr/bin/finadd2,/usr/bin/useradd

then do this
acountor ALL=NOPASSWD:ACCOUNTER

[Terrence]

This gets curiouser and curiourer. My mistake was in defining /usr/bin/useradd in my sudoers file. As all good unix admins know, useradd is in /usr/sbin. Then when I tried to test it, I correctly used /usr/sbin/useradd, but it failed because it wasn't in the sudoers files, /usr/bin/useradd was instead.

So you ask, why did you put /usr/bin/useradd in the sudoers file? Because I copied the entry out of the sudoers file of another near identical server that had sudo set up exactly as we need it by my predecessor. What's curious is that it works on the first machine despite the fact that it's defined as /usr/bin/useradd and not /usr/sbin/useradd in the sudoers file. The script that then uses sudo and useradd correctly references the path to useradd as /usr/sbin. Despite the fact that it's incorrect in sudoers, it still works.

Could the fact that the script that calls useradd is also given root access via sudo (its the file in my example above: /usr/bin/finadd2) mean that despite the fact that it's incorrect in visudoers, it still has access to useradd because the script (finadd2) is being run as root, and useradd is correctly referenced within the script? (/usr/sbin/useradd)? So a typo from 5 years ago went unnoticed because the belt and suspenders unix admin gave rights to useradd in two different ways, and despite the fact that one shouldn't work, the other way did work and therefore no one noticed?

Can anyone follow this convoluted logic? Does anyone care? Convince me I'm right or wrong for easy points!

[Mark Greene_1]

So a typo from 5 years ago went unnoticed because the belt and suspenders unix admin gave rights to useradd in two different ways, and despite the fact that one shouldn't work, the other way did work and therefore no one noticed?


I'd say that the use of fully qualified path names are what let this go unnoticed for so long, and that you very niftily deduced the root of your problem.

my $0.02

mark

[Terrence]

I guess I'm looking for some royalty with serious sudo credability to swear and affirm that by using sudo to give a low level no rights account access to run a script that is owned by root, then root owned commands like useradd that are called within that script are also available whether or they are also in the sudoers file.