Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

... but still be required for applications that need admin privilegies?

In order to allow the following:

$ apache2ctl restart
httpd not running, trying to start
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs

$ sudo !!
sudo apache2ctl restart             #no password asked
$                                   #works!

For reference I've seen this setup on amazon's e3 instances

Any idea?

share|improve this question
    
This is a great tutorial on the forums that details creating a separate file for specifying programs that you commonly use. And is a good idea for security reasons. –  Todd Partridge 'Gen2ly' May 13 '12 at 17:09
add comment

6 Answers 6

up vote 18 down vote accepted

You need to edit the sudoers file. Be advised that success gives you a less secure system and failure can break sudo. ALWAYS edit the sudoers file with sudo visudo , as visudo checks for errors and will not save the file if any are found.

It's a bad idea to give everything permission to run as root without a password, so to just let through the one executable you need(apache2ctl); append the following to the very bottom of the file:

YOURNAME ALL = NOPASSWD: /usr/bin/apache2ctl

You can replace the path to an executable with "ALL" if you choose, giving you complete passwordless sudo.

Replace YOURNAME with your username and press Ctrl + X to save and exit. If an error occurred, it will offer to revert, edit, or save anyway.

Be sure that you use the full path to an executable:
ie. /usr/bin/apache2ctl instead of just apache2ctl. This is important because without explicitly stating the path sudo will allow any program named apachectl on the user's current path to run as root. An exploit becomes as easy as mv malware ~/bin/apache2ctl!

share|improve this answer
3  
Note that %YOURNAME will give the permission to the group named like your user, which is normally not a problem since every normal user has a like-named group on Ubuntu systems. To give the permission to your user, specify YOURNAME without the %. –  Daniel Werner Oct 1 '12 at 12:10
add comment

You COULD add the nopasswd flag to the user list but that does not eliminate all passwords asked questions. Only the first one will be asked.

  1. Edit sudoers: sudo visudo (You HAVE TO use sudo. This is an admin file.)
  2. Add your user with the nopasswd flag after the Admin Line (at the end). For example:
    cyrex ALL = NOPASSWD: ALL or cyrex ALL = (ALL) NOPASSWD: ALL
share|improve this answer
add comment
sudo visudo
%<GROUP> ALL = NOPASSWD: apache2ctl

or

sudo visudo
%<GROUP> ALL = NOPASSWD: /etc/init.d/apache2

I guess this would do it.

But be careful with removing passwords for sudo.

share|improve this answer
1  
You should specify the absolute path in the first example, for security reasons -- an unscrupulous user could change $PATH and steal root access with an unqualified command name. –  bgvaughan May 15 '11 at 22:20
add comment

You'll need to edit '/etc/sudoers' file (there is 'visudo' command for that.) to add NOPASSWD prior to list of allowed commands for Your user or group. If Your user is in 'admin' group - You need following:

%admin ALL=(ALL) NOPASSWD: ALL

Check https://help.ubuntu.com/community/Sudoers , btw.

share|improve this answer
add comment

The real answer to this question can be complicated because sudo is very powerful, and can be configured to do cool things. This is thoroughly explained in the documentation.

The short answer is run sudo visudo in a terminal. If this is the first time that you have run visudo, it will ask you which editor you prefer. nano is generally thought to be the easiest to use, but pick the editor you are most comfortable/familiar with. You will need to decide who you want to give access to; it could be ALL for everyone (a very bad idea), a user, or a system group. Groups are prefixed with a % sign. For example, if you wanted to give everyone in the steroid_users group root privileges without the need for a password for all commands you would add:

%steroid_users ALL=(ALL) NOPASSWD: ALL

to the end of the file, exit, and save the file. If all goes well, and you are a member of the steroid_users group, you will be able to issue sudo *some-command* without the bother of needing to enter your password.

Keep in mind that anyone who has access to your terminal while you are logged in -- or if you have ssh setup for key-based auth, or (even worse) have enabled password free session logins -- complete and unfettered access to your entire system. If you have multiple users on your system, or if this is a file server, all users files could be at risk as root can do anything!

Also, if you make a mistake, visudo will output and error message and not save changes to the file. This will help prevent breaking sudo completely. You should really read the documentation. Sudo is designed to give users just enough access to do their job without the need to expose your entire system. It may be advantageous to only give password free access for certain commands.

I hope this helps.

share|improve this answer
    
Yes, it helps me a lot, thanks! –  Andy May 12 '12 at 6:06
    
That worked, I took this and then I used "sudo service sudo restart" from askubuntu.com/questions/192050/… and I was able to use all of this in my active Ubuntu session. Awesome! –  pthurmond Jun 17 '13 at 14:57
add comment

Now for the simple answer! No possible way to mess anything up or fudge your install up.

Just enter your password a couple times and then you'll never have to enter it again! This will allow you to add a local admin account to the group "root" which is then un-commented from a template which will allow the entire group "root" superuser privileges. You can read my security concern/solution for this procedure at the later part of this post.

%username& is the global variable for your username(replace it with desired username)

Step 1: Open up a terminal window and then type "sudo usermod -a -G root %username%"

Step 2: Then copy/paste this...

sudo sed -i 's/# auth       sufficient pam_wheel.so trust/auth       sufficient pam_wheel.so trust/g' /etc/pam.d/su`

Step 2 OR type

sudo nano /etc/pam.d/su`

Goto line 19 and remove the "#" before # auth sufficient pam_wheel.so trust (may be a different line number for some)

*The first command adds your %username% to the group "root"

The second/third commands allows all members of group "root" to be superuser without a password, versus only allowing the user "root" su privileges for authentications.


Endnote:

Don't mess around with /etc/sudoers... There are a lot of checks/balances that 'su' authentication must go through. Superuser authentication uses the same pam.d procedure as all other login authentications. "/etc/security/access.conf" has the layout for access control via tcp/ip(192.168.0.1) communication and through telnet services (tty1&tty2&tty3...etc) This allows more precise filtering per application via transport protocol. If safety is your concern, then your concern should be directed towards remote/code threats versus someone actually touching your computer when you leave the room!!!

Food for paranoia(dont type this one in just review it):

sudo sed -i 's/#-:ALL EXCEPT (wheel) shutdown sync:LOCAL/-:ALL EXCEPT (wheel) shutdown sync:LOCAL/g' /etc/security/access.conf

^ This blocks access to console for anyone who is not a member of system or root. Sometimes programs install usernames/groups that are exploited!

share|improve this answer
    
Not a security expert but it sounds a bit counter intuitive. You are disabling passwords for an entire group to allow a single user run a specific app without a password to avoid the "complexity" of refining sudo for a particular application, right? And all this on a public server? Did the script disable your basic survival instincts? Security is COMPLEX BY DESIGN. Remember, it's like an onion. It has layers and it makes you cry... Data loss on compromised servers is only part of the equation. A hacker spring-boarding attacks from your system is equally serious but often overlooked –  hmayag Apr 13 at 21:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.