sudo question

[Tom Wolf_3]

Hello all.
On one of our HP-UX 11.11 servers I have sudo configured to allow user joe to execute script /opt/submit as user ivan.

User joe executes the following command as himself and enters his password when prompted.


$ sudo -u ivan /opt/submit

The /opt/submit script requires ivan's environment variables to execute properly but when joe executes this command it's using his environment variables and not ivan's.

How would I address this?

By the way we're running sudo version 1.6.3.

Thanks in advance.

[Jeeshan]

then you might have to be set ivan's variable to joe and then try to execute.

[George Spencer_4]

How about:

sudo -u ivan ". ~ivan/.profile; /opt/submit"

but you will have to change the sudoers file.

or

sudo su - ivan /opt/submit

[johnsonpk]

Hi Tom,

You can try this ,

#sudo -i -u ivan /opt/submit

Rgds
Johnson

[Patrick Wallek]

The easier thing would be to set the required environment variables inside the /opt/submit script.

If a script requires a specific environment, set it in the script. Never trust that the users environment will be correct. By setting the environment in the script, you KNOW it will always be correct.

[Sajjad Sahir]

Dear Tom

Please list of who can run what

/etc/sudoers

thanks and regards

Sajjad Sahir

[F Verschuren]

to go throu the profile use:
sudo su - ivan -c "/opt/submit"

do gain this acces you need to change the sudo config:
joe ALL=(ALL) PASSWD:/usr/bin/su - ivan -c /opt/submit

[Ralph Grothe]

Hi Tom,

I guess that you could also set the Defaults for user joe by setting env_keep in sudoers and listing which of joe's environment variables which would otherwise be unset (apart from LOGNAME, HOME etc. even when invoked as "sudo -i -u joe /opt/submit".

Though I haven't tried it, it might work.
As root run visudo.
Then add this to your sudoers:

Defaults:joe env_keep="JOES_ENV_VAR1 JOES_ENV_VAR2...JOES_ENV_VARN"

Substitute JOES_ENV_VAR? above by those variables of joe's login environment that you wish to be preserved. The variables in the double quotes need to be delimited by whitespace.

[Ralph Grothe]

Sorry, I mixed up joe and ivan in your example.
But I guess you can gather how it's meant.
Also the line break of my Deafults line shouldn't appear in the sudoers file. this was only caused by the webserver after having submitted my reply.

[Tom Wolf_3]

Thanks to all who replied.
We upgraded sudo from version 1.6.3 (which didn't have the "-i" option - simulate initial login) to version 1.7.1 (which does have the "-i" option). We also had to add the korn shell /usr/bin/ksh to /etc/sudoers.

Once that was done, user joe could execute the /opt/submit script as ivan with ivan's environment variables by running the following:

$ sudo -i -u ivan /opt/submit

Thanks again for the help.