Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Below is what I know:

I have to add this below line in sudoers file to give rights to the user for particular task.

user_name ALL=NOPASSWD: /usr/bin/apt-get install

In this case I want to give access to this user to restart 2 services (i.e. Apache and MySQL) with all install rights.

Using the above line, I have given him all install rights, now do I have to add same line two more times to give the rights for services? Or can I just add those commands in the same line, separated by comma or something?

share|improve this question
    
@FEichinger thanks a lot... :) –  Rishee Jan 23 '13 at 10:52
add comment

2 Answers 2

up vote 11 down vote accepted

I have solved the issue by creating a new group for limited admin rights... name of that group is LimitedAdmins after that I updated the sudoers file as below.

The line I appended is:

%LimitedAdmins ALL=NOPASSWD: /usr/bin/apt-get*, /etc/init.d/apache2 restart

This is the complete /etc/sudoers file:

# This file MUST be edited with the 'visudo' command as root.    
#   
# Please consider adding local content in /etc/sudoers.d/ instead of directly modifying   his file.   
#   
# See the man page for details on how to write a sudoers file.  
# 
Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL  

#includedir /etc/sudoers.d
%domain_name\\administrators ALL=(ALL) ALL
%LimitedAdmins ALL=NOPASSWD: /usr/bin/apt-get*, /etc/init.d/apache2 restart

It works perfectly fine in case if your system is domain or not.

share|improve this answer
    
You're not supposed to put stuff after the #includedir line are you? –  hamstar Aug 13 '13 at 2:26
    
@hamstar Hey Hi! Yes you are right, thou I have used this configuration file in my company for more than 2 years now & it works perfectly fine. Even thou I would also recommend, to put the last two lines before #includedir. –  Rishee Aug 14 '13 at 2:51
1  
Or better, put those two lines into a new file under /etc/sudoers.d instead of editing /etc/sudoers. –  tgharold Sep 12 '13 at 17:55
    
@tgharold Yes buddy!! You are right... it is really a better option than what I have suggested... :) Appreciate your idea will try to implement at my place as well. –  Rishee Sep 14 '13 at 16:59
    
Is #includedir a comment? Or does the include happen automatically and the comment just reminds us of that? –  HeatfanJohn Feb 22 at 17:11
show 1 more comment

Looks like comma is what you need.

Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
...
user3 ALL= PRINTING

Source

share|improve this answer
    
I have given rights the way you mentioned it however I got the error message as below. <br/>E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied) <br/> E: Unable to lock the administration directory (/var/lib/dpkg/), are you root? ... can anyone help on this? –  Rishee Jan 23 '13 at 9:17
    
@Rishee I will try once I get home –  Karthik T Jan 23 '13 at 10:03
    
my sudores file contains below mentioned things. –  Rishee Jan 23 '13 at 10:31
    
# User privilege specification root ALL=(ALL:ALL) ALL # Members of the admin group may gain root privileges %admin ALL=(ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL #includedir /etc/sudoers.d $ sudo nano /etc/sudoers %Domain_Name\\administrators ALL=(ALL) ALL %Domain_Name\\user.name ALL=NOPASSWD: /usr/bin/apt-get install, /etc/init.d/apache2 restart –  Rishee Jan 23 '13 at 10:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.