Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm logged in with a normal user account that isn't member of the groups sudo and admin. When I run the following example command..

su -c 'sudo some_command_that_needs_sudo' sudo-user

..it's necessary to enter the password twice. The first time to login as sudo-user and the second time because we request root privileges using sudo.

Do you know how to prevent entering the password a second time?

Please keep in mind..

  • ..don't want to change any user privileges
  • ..want to enter password just once
  • ..looking for a simple single command
share|improve this question

1 Answer 1

up vote 1 down vote accepted

Your configuration is a little abnormal. Normally you would add your username to sudoers, and limit the applications that can be executed in this manner if required. Without knowing more detail, I can't see any benefit to introducing a third account. It just introduces more indirection, which is what you're encountering now.

The first password you enter is to become the sudo-user. You can't avoid this - you're switching users. Here are some crazy workarounds that come to mind which you shouldn't use.

  • You could set an empty password for the user to make login simpler, but that would be an insane security risk. Do not do this.
  • You could automate the login with expect and a hardcoded password. This is no more secure than the previous suggestion. Do not do this.
  • You could use ssh. You'd create a ssh key as the sudo-user, copy it to your user's .ssh dir, permission it for your user, append it to the sudouser's .ssh/authorized_keys, and then use: ssh -i .ssh/sudouser_id_rsa sudouser@localhost <command>. It may work, but it's crazy.

The second password can easily be removed by editing the sudoers file with visudo and setting the sudouser as NOPASSWD. This is a more common operation. You can even limit the commands which don't require a password, which is obviously recommended if you only intend to run a few commands in this manner. Note, however, that unless this sudo user is treated very seriously, having a NOPASSWD policy is not a good idea. Generally speaking, it isn't a good idea regardless.

A configuration which can run all commands without a password prompt would look like:

sudouser ALL= NOPASSWD: ALL

Bottom line - I don't see why you're using this three account configuration. Setting that to one side, in terms of giving you what you asked for, allowing the sudo user to run certain commands without being prompted for a password is the most sensible route.

You have to be careful though - that creates a less secure setup.

As an aside, it is technically possible to achieve a zero authentication solution within your guidelines, by using both ssh key-based authentication and NOPASSWD for the sudo user, so your commands would look like:

ssh -i .ssh/sudouser_id_rsa sudouser@localhost sudo whatever_i_like

That's obviously way beyond insecure - that's just plain open. I shouldn't need to say it, but don't do that.

share|improve this answer
    
Hey IlluminAce, thanks for your advice. Normally I am working with a normal user account but sometimes its necessary to execute some sudo stuff. I expect I have to arrange with typing the password twice.Another solution might be to reactivate root to use this account instead of sudo-user. –  eldiamo Mar 24 '13 at 22:29
    
Yes, you should really either enable sudo for your account (and limit it to the command(s) you occasionally require), or continue to put up with the dual login, or enable the root account. The most advisable, as far as I'm concerned, would be one of the first two. –  IlluminAce Mar 27 '13 at 22:39
    
I had to ignore my own guideline a little bit but I think this seems to be the best solution. Edit /etc/sudoers, add the affected user to the sudo-user list and list all necessary commands like username ALL=/path/script1 option,/path/script2 option, ... –  eldiamo May 15 '13 at 10:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.