21

This might be a very naive question, but I wanted to know how I could give multiple users access to a single computer without making them root users. How would I give them limitted sudo access such that they could still issue commands like

sudo apt-get install epstopdf

I imagine this could be an incredibly stupid question as once root user access is given, they could do whatever they want. Therefore, is there any way around this? I am open to suggestions

3 Answers 3

29

Open a terminal and type sudo visudo. At the end of the file (really the last line in it) type %yourusername% ALL=NOPASSWD: /usr/bin/apt-get install where %yourusername% is replaced by your username.

After that you wont be prompted for a password to use sudo apt-get install anymore but please understand this is a very risky solution, there is a reason why you need to type a password for some commands, the use of these commands without password can leave your system open for some dangers. Use with caution.

6
  • Could sudo apt-get install lead to problems by, for example, installing a program which does rm -f -r / ?
    – puk
    Oct 31, 2011 at 20:43
  • 4
    Well, no not really. And if it does you need to type sudo rm -rf / and the instructions I gave are only to enable sudo apt-get install, even if you enable a PPA that has that kind of code, even if you install it without really knowing what you are doing and the program tries to run he wont have access... You did not give yourself sudo rm permition, only sudo apt-get install. Its the safest approach to a insecure situation ;) Oct 31, 2011 at 20:50
  • fixed the path to the file was wrong :D the path was not /usr/sbin but /usr/bin ;) it just works Oct 31, 2011 at 21:15
  • Sudo with a password isn't much more secure than without. In fact in someways it can be considered less secure depending on the situation. If you are in a position to use the sudo command it's fairly easy to override it in a bash profile. You can install a fake sudo that logs the password. Having the password would allow other hosts to be compromised (if they allow password logins), or other sudo commands to be run. If you allow passwordless sudo for specific commands then that isn't such an issue. One time passwords are also another possibility but you can still hijack the sudo. Dec 13, 2014 at 22:42
  • 2
    On Ubuntu 15.04 this disallows a meaningful install, allowing literally sudo /usr/bin/apt-get install with no parameters. If a package name is added then sudo asks for a password and gives a "Sorry..." error.
    – Paul
    Jun 5, 2015 at 5:03
8

sudo is exactly made for that. By editing the sudoers file you can give users specific privileges. See the manual page of sudoers(5) for details.

2

From my answer to similar question on the Linux stachkexchange: link

For me the option with visodo required additional steps:

  1. Add yourself to the sudousers:

Login as root via su -, open sudo editor by visudo and add next lines:

%yourusername% ALL=NOPASSWD: /usr/bin/apt-get install
%yourusername% ALL=NOPASSWD: /var/lib/dpkg/lock-frontend
  1. Exit session(root and yours) typing exit <Enter> exit <\Enter>

  2. Reopen it and type:

     sudo chown  %yourusername%: /var/lib/dpkg/lock-frontend
     chmod  u+w /var/lib/dpkg/lock-frontend 
     sudo chown  %yourusername%: /var/lib/dpkg/lock
     chmod  u+w /var/lib/dpkg/lock
     sudo chown  %yourusername%: /var/cache/apt/archives/lock
     chmod  u+w /var/cache/apt/archives/lock
     sudo chown  %yourusername%:  /var/lib/apt/lists/lock
     chmod  u+w  /var/lib/apt/lists/lock
    

PS: I also added the visudo file lines to allow myself to update repos list:

%yourusername% ALL=NOPASSWD: /usr/bin/apt-get update

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .