Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Background: I have a development machine with LAMP setup. Several developers would access the machine from time to time. Every time they make some change in a configuration file they will need to restart the apache server using sudo service apache restart or sudo /etc/init.d/apache2 restart

The Question:

What I want now is that every developer who accesses the machine does not have a sudo access to everything. Rather, he/she should only be able to run the service command using sudo and nothing else. Is it possible to do that?

share|improve this question
add comment

1 Answer 1

up vote 13 down vote accepted

yes.

Make a new group, web (call it what you wish)

sudo addgroup web

Add your developer(s) to the web group (use their login name).

sudo usermod -a -G web your_developer(s)

Then run sudo visudo

Add in a line

%web ALL=(ALL) /usr/bin/service apache2 *

The developers can then run

sudo service

using their log in password

Do NOT add your admin user to the web group

see man sudoers for additional information

share|improve this answer
    
thanks u saved my day –  Ankit Dec 27 '11 at 6:55
1  
@Ankit: that way the users of web group can start/stop any service, and this is not what you want, I think. The solution should be to put the exact command (also with parameters) in /etc/sudoers. –  enzotib Dec 27 '11 at 10:23
    
@enzotib can i do that to i mean so the new command would be /usr/bin/service apache2 is it? –  Ankit Dec 27 '11 at 12:08
2  
@Ankit: /usr/bin/service apache2 * –  enzotib Dec 27 '11 at 13:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.