0

I have some automated tools that need to be able to run as a specific user. The username is "ig_root" and it is only used by a monitoring tool (checks disk space, database, CPU workload, etc) that sends us warnings when something may need human intervention.

What we need to be able to do is to issue a sudo command to run things as the ig_root user. I have my "invadm" account that is a member of sudo group, and it can "sudo su - root", but it prompts for a password. What I need to set up is to be able to do something similar for a non-root user but that does NOT prompt for the password.

In other words, as "invadm" user we want to do this:

# sudo -u ig_root check_dbspace

...without seeing this:

[sudo] password for invadm:

But I also want conecting to root to still require the password entry for everyone:

# sudo su - root
[sudo] password for invadm:

Is that possible?

My current visudo entries look like this on my test server:

# User privilege specification
root    ALL=(ALL:ALL) ALL
invadm  ALL=(ig_root) NOPASSWD: ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Any ideas as to what I'm missing? I thought maybe I have to issue the systemctl and stop/restart something, but I learned that there is no sudo daemon to restart. I also tried logging out and back in to pick up any new environment... no luck.

Right now, the only account that sudo does not ask for a password is when I'm root user.

# sudo -u ig_root whoami
ig_root
Improve this question
1
  • Forgot to mention this is Ubuntu Server 18.04 LTS
    – S. Nixon
    Nov 11, 2020 at 22:30

1 Answer 1

Reset to default
1

I think the problem is that when several entries match for the same user, the last match is used. Since invadm is in group sudo the %sudo entry applies, hence the request for a password.

Simply move your specific rules to the end of the file.

Improve this answer
2
  • Dang! You are exactly right. Taking the exact same "invadm" line, I moved that to the bottom of the sudoers file and now invadm user is NOT prompted for a password when trying to run things as ig_root user. Thanks so much for this. I was under the impression each section was similar to the stanzas in some config files, and that I needed my entry under the "User privilege specs" section.
    – S. Nixon
    Nov 12, 2020 at 16:23
  • No, there is no structure to the sudoers file. sudo -ll can show you what it thinks you can do, but I don't know if it would provide any clues in this sort of case.
    – meuh
    Nov 12, 2020 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .