Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

On one particular machine I often need to run sudo commands every now n then.
I am fine with entering password on sudo in most of the cases.

However there are three sudo commands I want to run without entering password:

  • sudo reboot
  • sudo shutdown -r now
  • sudo shutdown -P now

How can i exclude these commands from password protection to sudo?

share|improve this question
1  
Similar to How to allow execution without using the sudo? –  InkBlend Aug 6 '12 at 0:37

1 Answer 1

up vote 71 down vote accepted

Use the NOPASSWD directive

You can use the NOPASSWD directive in your /etc/sudoers file.

If your user is called user and your host is called host you could add these lines to /etc/sudoers:

user host = (root) NOPASSWD: /sbin/shutdown
user host = (root) NOPASSWD: /sbin/reboot

This will allow the user user to run the desired commands on host without entering a password. All other sudoed commands will still require a password.

Note! Use the command visudo to edit the sudoers file to make sure you do not lock yourself out of the system – just in case you accidentally write something incorrect to the sudoers file.

Using /etc/sudoers.d instead of modifying /etc/sudoers

As an alternative to editing the /etc/sudoers file, you could add the two lines to a new file in /etc/sudoers.d e.g. /etc/sudoers.d/shutdown. This is an elegant way of separating different changes to the sudo rights and also leaves the original sudoers file untouched for easier upgrades.

Note! Again, you should use the command visudo to edit the file to make sure you do not lock yourself out of the system:

sudo visudo -f /etc/sudoers.d/shutdown 

This also automatically ensures that the owner and permissions of the new file is set correctly.

If sudoers is messed up

If you did not use visudo to edit your files and then accidentally messed up /etc/sudoers or messed up a file in /etc/sudoers.d then you will be locked out of sudo.

The solution could be to fix the files using pkexec which is an alternative to sudo.

To fix /etc/sudoers:

pkexec visudo

To fix /etc/sudoers.d/shutdown:

pkexec visudo -f /etc/sudoers.d/shutdown

If the ownership and/or permissions are incorrect for any sudoers file, the file will be ignored by sudo so you might also find yourself locked out in this situation. Again, you can use pkexec to fix this.

The correct permissions should be like this:

$ ls -l /etc/sudoers.d/shutdown 
-r--r----- 1 root root 86 Jul 16 15:37 /etc/sudoers.d/shutdown

Use pkexec like this to fix ownership and permissions:

pkexec chown root:root /etc/sudoers.d/shutdown
pkexec chmod 0440 /etc/sudoers.d/shutdown
share|improve this answer
    
i hope this will only apply to these 2 commands, and I won't be messing up with the rest of the system or any other command? –  Z9iT Jul 4 '12 at 12:32
2  
The two lines refer specifically to these two commands. If user is not in other ways given sudo rights no other commands can be sudoed by this user. Have a look at man sudo and man sudoers. –  mgd Jul 5 '12 at 15:27
    
Initially I faced a chmod problem.. added a workout to this in the answer.. thanx @mgd –  Z9iT Jul 5 '12 at 18:28
    
Thx! I think the information about what the proper ownership and permissions are was useful though--you may want to keep that in the answer as well. (You could even mention how to fix it with pkexec if it's been messed up, if you want.) –  Eliah Kagan Jul 16 '12 at 14:54
    
Awesome explanation –  hamstar Aug 13 '13 at 2:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.