Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have to write a script and it requires root privileges to execute some linux commnads and to stop & start some services. I'm asked to disable sudo access totally for all the users (as the normal users can gain access to root with the command 'sudo -s') and I did it. So I'm looking for the script to automate the switch user password(su) which does not need user intervention.

EDIT:1

On further research I got following script what I'm in need of:

#!/usr/bin/python
import pexpect
import os
passwd = "my-root-password-here"
child = pexpect.spawn('su root')
child.expect('Password:')
child.sendline(passwd)
child.expect('$')
child.interact()

I have checked this script executing manually logging in as normal user and it switched to root without any problem. But when I type exit/ctrl+d to switch back to the normal user, I'm getting following error:

Traceback (most recent call last):
 File "./su3.py", line 9, in <module>
  child.interact()
File "/usr/lib/python2.6/dist-packages/pexpect.py", line 1492, in interact
  self.__interact_copy(escape_character, input_filter, output_filter)
File "/usr/lib/python2.6/dist-packages/pexpect.py", line 1520, in __interact_copy
  data = self.__interact_read(self.child_fd)
File "/usr/lib/python2.6/dist-packages/pexpect.py", line 1510, in __interact_read
  return os.read(fd, 1000)
OSError: [Errno 5] Input/output error

any help...

share|improve this question
    
All the answers are right here!. I'm marking an answer as accepted which has more votes. –  user3215 Jan 31 '11 at 16:01

3 Answers 3

up vote 3 down vote accepted

Users cannot run sudo -s if they don't have permissions to run whatever the SHELL is.

What you want is to have your users tell you exactly what commands they want to be able to run. Be especially careful that any commands they want to run are owned by root so they can't replace them with something that elevates their privileges later.

If they want to be able to run ifconfig for instance,

%netadmins ALL=(ALL) NOPASSWD: /sbin/ifconfig

Try that, and you'll see that the netadmins group can only run /sbin/ifconfig with no password entered as root.

share|improve this answer
    
Thanks a lot for sharing your knowledge and it will be useful for many! –  user3215 Jan 31 '11 at 16:05

If you need to run that script as a non-root user, you should configure sudo to allow that. You can configure sudo per user or group to allow all or only certain commands, either with or without password. Completely disabling sudo for all users is probably not what you want...

share|improve this answer
    
As the users can easily gain access to root simply entering their own password with the command 'sudo -s', I had to disable sudo completely. I have tried some scripts but that didn't work for me. –  user3215 Oct 28 '10 at 9:16
1  
sudo -s only works if you allow it (e.g. on Ubuntu, it's allowed for all users that are members of the ‘admin’ group, but not for other users). You should read the sudo & sudoers & visudo documentation to learn more about this. I need some sleep before providing you examples though... ;-) –  JanC Oct 28 '10 at 11:06
    
Thanks a lot for your valuable information! –  user3215 Jan 31 '11 at 16:03

You could set the execute sticky bit on that script so that it will always execute as the owner of the script. Something like chmod 4750 script_name

Expect can be used to automate responses in a script. Be careful with either of these as they can introduce security risks, especially when giving regular users elevated privileges.

Properly configuring sudo, instead of disabling it completely, as JanC stated, is probably the best solution.

share|improve this answer
    
Having assigned the sticky bit still says "You need root privileges to run this script". Yes, I'm looking for the expect script but I can't do myself as I'm poor at programming. –  user3215 Oct 28 '10 at 10:07
    
Is the script owned by root? Setting the sticky bit as above will execute as the script owner. There are many expect examples online. Try Expect Examples. –  hannaman Oct 28 '10 at 10:36
1  
The "sticky" bit does not control what user an executable runs as. In normal files, it basically does nothing (it was an old unix trick to get a file to "stick" in RAM). On directories, it does cause the permissions to work a bit differently, so that even if you have write access, you can only rename and delete your own files. This is for temp directories. –  SpamapS Nov 3 '10 at 18:51
    
What you probably meant was the setuid bit. This would work if his script were an actual binary executable, but this does not work on scripts. –  SpamapS Nov 3 '10 at 18:51
    
-1 The setuid bit does not work for shell scripts –  João Pinto Nov 3 '10 at 19:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.