45

... but still be required for applications that need admin privilegies?

In order to allow the following:

$ apache2ctl restart
httpd not running, trying to start
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

$ sudo !!
sudo apache2ctl restart             #no password asked
$                                   #works!

For reference I've seen this setup on amazon's e3 instances

Any idea?

1
  • This is a great tutorial on the forums that details creating a separate file for specifying programs that you commonly use. And is a good idea for security reasons. May 13, 2012 at 17:09

6 Answers 6

58

You need to edit the sudoers file. Be advised that success gives you a less secure system and failure can break sudo. ALWAYS edit the sudoers file with sudo visudo , as visudo checks for errors and will not save the file if any are found.

It's a bad idea to give everything permission to run as root without a password, so to just let through the one executable you need(apache2ctl); append the following to the very bottom of the file:

YOURNAME ALL = NOPASSWD: /usr/bin/apache2ctl

You can replace the path to an executable with "ALL" if you choose, giving you complete passwordless sudo.

Replace YOURNAME with your username and press Ctrl + X to save and exit. If an error occurred, it will offer to revert, edit, or save anyway.

Be sure that you use the full path to an executable:
ie. /usr/bin/apache2ctl instead of just apache2ctl. This is important because without explicitly stating the path sudo will allow any program named apachectl on the user's current path to run as root.

8
  • 3
    Note that %YOURNAME will give the permission to the group named like your user, which is normally not a problem since every normal user has a like-named group on Ubuntu systems. To give the permission to your user, specify YOURNAME without the %. Oct 1, 2012 at 12:10
  • Is there a way to be more restructive ? (some functions of executable only)
    – 3pic
    Sep 4, 2015 at 12:15
  • 1
    Old post, but I would definitely complete that answer by restricting the sudoers' entry to a particular hostname (if possible), and either to given arguments o to no argument at all (following apache2ctl), like so: YOURNAME YOUR-HOSTNAME = NOPASSWD: /usr/bin/apache2ctl <specific arg | "">. --- In all cases man 5 sudoers is the reference to go to.
    – Cbhihe
    Apr 25, 2016 at 13:11
  • @Cbhihe I tried the above command and it didn't work with arguments. Are you sure You can run a program with args set in the Sudoers file? for instance I have a SIP program Asterisk. when I add the entry as user hostname = (asterisk) NOPASSWD: /usr/sbin/asterisk -rx "pjsip show channelstat" it never let me runs that command. only if I add /usr/sbin/asterisk without the arguments it will run the program but it seems bad practise to be able to run any arg
    – Definity
    Jun 2, 2023 at 10:49
  • @Definity, careful w/ necroposting, although in this case, if you posted a new question, avoiding a dupe would be hard.... To answer you: specifying a fully qualified command name with argument(s) is well documented and I use it on various Debian- and Suse-based OSes. What I am not sure about if whether your issue is due your use of double quotes. You might want to try to escape each once and, if it falls through, twice, as in (for the latter case): user hostname = (asterisk) NOPASSWD: /usr/sbin/asterisk -rx \\"pjsip show channelstat\\". man 5 sudoers is your go-to reference ....
    – Cbhihe
    Jun 4, 2023 at 20:02
27

The real answer to this question can be complicated because sudo is very powerful, and can be configured to do cool things. This is thoroughly explained in the documentation.

The short answer is run sudo visudo in a terminal. If this is the first time that you have run visudo, it will ask you which editor you prefer. nano is generally thought to be the easiest to use, but pick the editor you are most comfortable/familiar with. You will need to decide who you want to give access to; it could be ALL for everyone (a very bad idea), a user, or a system group. Groups are prefixed with a % sign. For example, if you wanted to give everyone in the steroid_users group root privileges without the need for a password for all commands you would add:

%steroid_users ALL=(ALL) NOPASSWD: ALL

to the end of the file, exit, and save the file. If all goes well, and you are a member of the steroid_users group, you will be able to issue sudo *some-command* without the bother of needing to enter your password.

Keep in mind that anyone who has access to your terminal while you are logged in -- or if you have ssh setup for key-based auth, or (even worse) have enabled password free session logins -- complete and unfettered access to your entire system. If you have multiple users on your system, or if this is a file server, all users files could be at risk as root can do anything!

Also, if you make a mistake, visudo will output and error message and not save changes to the file. This will help prevent breaking sudo completely. You should really read the documentation. Sudo is designed to give users just enough access to do their job without the need to expose your entire system. It may be advantageous to only give password free access for certain commands.

I hope this helps.

1
  • That worked, I took this and then I used "sudo service sudo restart" from askubuntu.com/questions/192050/… and I was able to use all of this in my active Ubuntu session. Awesome!
    – Patrick
    Jun 17, 2013 at 14:57
5

You'll need to edit '/etc/sudoers' file (there is 'visudo' command for that.) to add NOPASSWD prior to list of allowed commands for Your user or group. If Your user is in 'admin' group - You need following:

%admin ALL=(ALL) NOPASSWD: ALL

Check https://help.ubuntu.com/community/Sudoers , btw.

3

You COULD add the nopasswd flag to the user list but that does not eliminate all passwords asked questions. Only the first one will be asked.

  1. Edit sudoers: sudo visudo (You HAVE TO use sudo. This is an admin file.)
  2. Add your user with the nopasswd flag after the Admin Line (at the end). For example:
    cyrex ALL = NOPASSWD: ALL or cyrex ALL = (ALL) NOPASSWD: ALL
2
sudo visudo
%<GROUP> ALL = NOPASSWD: apache2ctl

or

sudo visudo
%<GROUP> ALL = NOPASSWD: /etc/init.d/apache2

I guess this would do it.

But be careful with removing passwords for sudo.

1
  • 2
    You should specify the absolute path in the first example, for security reasons -- an unscrupulous user could change $PATH and steal root access with an unqualified command name.
    – bgvaughan
    May 15, 2011 at 22:20
0

Now for the simple answer! No possible way to mess anything up or fudge your install up.

Just enter your password a couple times and then you'll never have to enter it again! This will allow you to add a local admin account to the group "root" which is then un-commented from a template which will allow the entire group "root" superuser privileges. You can read my security concern/solution for this procedure at the later part of this post.

%username& is the global variable for your username(replace it with desired username)

Step 1: Open up a terminal window and then type "sudo usermod -a -G root %username%"

Step 2: Then copy/paste this...

sudo sed -i 's/# auth       sufficient pam_wheel.so trust/auth       sufficient pam_wheel.so trust/g' /etc/pam.d/su`

Step 2 OR type

sudo nano /etc/pam.d/su`

Goto line 19 and remove the "#" before # auth sufficient pam_wheel.so trust (may be a different line number for some)

*The first command adds your %username% to the group "root"

The second/third commands allows all members of group "root" to be superuser without a password, versus only allowing the user "root" su privileges for authentications.


Endnote:

Don't mess around with /etc/sudoers... There are a lot of checks/balances that 'su' authentication must go through. Superuser authentication uses the same pam.d procedure as all other login authentications. "/etc/security/access.conf" has the layout for access control via tcp/ip(192.168.0.1) communication and through telnet services (tty1&tty2&tty3...etc) This allows more precise filtering per application via transport protocol. If safety is your concern, then your concern should be directed towards remote/code threats versus someone actually touching your computer when you leave the room!!!

Food for paranoia(dont type this one in just review it):

sudo sed -i 's/#-:ALL EXCEPT (wheel) shutdown sync:LOCAL/-:ALL EXCEPT (wheel) shutdown sync:LOCAL/g' /etc/security/access.conf

^ This blocks access to console for anyone who is not a member of system or root. Sometimes programs install usernames/groups that are exploited!

2
  • 2
    Not a security expert but it sounds a bit counter intuitive. You are disabling passwords for an entire group to allow a single user run a specific app without a password to avoid the "complexity" of refining sudo for a particular application, right? And all this on a public server? Did the script disable your basic survival instincts? Security is COMPLEX BY DESIGN. Remember, it's like an onion. It has layers and it makes you cry... Data loss on compromised servers is only part of the equation. A hacker spring-boarding attacks from your system is equally serious but often overlooked
    – hmayag
    Apr 13, 2014 at 21:47
  • 3
    It's counter intuitive and counter common-sense: Opening the whole cookie jar for a user who only needs one cookie is pretty irresponsible. You would add users to the sudoers list and remove the need to enter passwords rather than editing the sudoers file/files. "If a handgun is unsafe for children, do not give them a canon." -me
    – John
    Apr 9, 2015 at 5:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .