Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm using Ubuntu 10.04 LTS server, with the default security model (root locked, using sudo to elevate privileges). I occasionally enjoy using sudo -i when I'll need to run a series of commands with elevated privileges, or when I need to rummage around in directories with root-only privileges.

Sometimes, when setting up software that'll run as its own non-privileged system account (adduser --system --group --no-create-home --disabled-login some-daemon-user) I find that I need to run a sequence of commands as that user, rather than myself or root. I've tried using sudo -i -u some-daemon-user, but it just returns a 1 status without any error message.

I've checked the syslog, messages, auth, and debug log files in /var/log and none of them include any messages that reference sudo or the account in question.

So, is it possible to become another non-root user, sudo-style without just setting a password and logging in (as them)? Is my system 'broken' in some way or am I just doing it wrong?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Ahmm.. the problem is that the standard shell of those users is normally set to /bin/false and for security reasons you should not change this. But you can still run for example: sudo -u www-data /bin/sh

share|improve this answer
1  
Can you give more details on the "security reasons"? Is it any different if I use sudo to run a shell as the user, as Florian suggests above? –  Calrion Oct 29 '12 at 2:42
1  
The reason is, that any attacker accomplishing a login as a system user, i.e. by exploiting a bug in the login program, is less likely to end up with a valid shell. So, you should leave the setting as it is in the /etc/passwd file, even if it's just for good karma. Invoking the shell directly via sudo is unrelated to this. –  Paul Hänsch Oct 29 '12 at 2:46
    
So the issue is setting a shell in the passwd file, not actually running a shell as the user. Gotcha! –  Calrion Oct 29 '12 at 2:48

sudo -i runs the shell specified by the password database entry of the target user, which is /bin/false for your system user.

Use

 sudo -u some-daemon-user bash

or

sudo -u some-daemon-user -H bash

if you want to set the $HOME environment variable set for the target user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.