0

I have some automated tools that need to be able to run as a specific user. The username is "ig_root" and it is only used by a monitoring tool (checks disk space, database, CPU workload, etc) that sends us warnings when something may need human intervention.

What we need to be able to do is to issue a sudo command to run things as the ig_root user. I have my "invadm" account that is a member of sudo group, and it can "sudo su - root", but it prompts for a password. What I need to set up is to be able to do something similar for a non-root user but that does NOT prompt for the password.

In other words, as "invadm" user we want to do this:

# sudo -u ig_root check_dbspace

...without seeing this:

[sudo] password for invadm:

But I also want conecting to root to still require the password entry for everyone:

# sudo su - root
[sudo] password for invadm:

Is that possible?

My current visudo entries look like this on my test server:

# User privilege specification
root    ALL=(ALL:ALL) ALL
invadm  ALL=(ig_root) NOPASSWD: ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Any ideas as to what I'm missing? I thought maybe I have to issue the systemctl and stop/restart something, but I learned that there is no sudo daemon to restart. I also tried logging out and back in to pick up any new environment... no luck.

Right now, the only account that sudo does not ask for a password is when I'm root user.

# sudo -u ig_root whoami
ig_root
1
  • Forgot to mention this is Ubuntu Server 18.04 LTS – S. Nixon Nov 11 '20 at 22:30
1

I think the problem is that when several entries match for the same user, the last match is used. Since invadm is in group sudo the %sudo entry applies, hence the request for a password.

Simply move your specific rules to the end of the file.

2
  • Dang! You are exactly right. Taking the exact same "invadm" line, I moved that to the bottom of the sudoers file and now invadm user is NOT prompted for a password when trying to run things as ig_root user. Thanks so much for this. I was under the impression each section was similar to the stanzas in some config files, and that I needed my entry under the "User privilege specs" section. – S. Nixon Nov 12 '20 at 16:23
  • No, there is no structure to the sudoers file. sudo -ll can show you what it thinks you can do, but I don't know if it would provide any clues in this sort of case. – meuh Nov 12 '20 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.