56

Below is what I know:

I have to add this below line in sudoers file to give rights to the user for particular task.

user_name ALL=NOPASSWD: /usr/bin/apt-get install

In this case I want to give access to this user to restart 2 services (i.e. Apache and MySQL) with all install rights.

Using the above line, I have given him all install rights, now do I have to add same line two more times to give the rights for services? Or can I just add those commands in the same line, separated by comma or something?

Improve this question
0

4 Answers 4

Reset to default
66

I have solved the issue by creating a new group for limited admin rights... name of that group is LimitedAdmins after that I updated the sudoers file as below.

The line I appended is:

%LimitedAdmins ALL=NOPASSWD: /usr/bin/apt-get*, /etc/init.d/apache2 restart

This is the complete /etc/sudoers file: 

# This file MUST be edited with the 'visudo' command as root.    
#   
# Please consider adding local content in /etc/sudoers.d/ instead of directly modifying   his file.   
#   
# See the man page for details on how to write a sudoers file.  
# 
Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL  

#includedir /etc/sudoers.d
%domain_name\\administrators ALL=(ALL) ALL
%LimitedAdmins ALL=NOPASSWD: /usr/bin/apt-get*, /etc/init.d/apache2 restart

It works perfectly fine in case if your system is domain or not.

Improve this answer
9
  • You're not supposed to put stuff after the #includedir line are you?
    – hamstar
    Aug 13, 2013 at 2:26
  • @hamstar Hey Hi! Yes you are right, thou I have used this configuration file in my company for more than 2 years now & it works perfectly fine. Even thou I would also recommend, to put the last two lines before #includedir.
    – Hrish
    Aug 14, 2013 at 2:51
  • 8
    Or better, put those two lines into a new file under /etc/sudoers.d instead of editing /etc/sudoers.
    – tgharold
    Sep 12, 2013 at 17:55
  • @tgharold Yes buddy!! You are right... it is really a better option than what I have suggested... :) Appreciate your idea will try to implement at my place as well.
    – Hrish
    Sep 14, 2013 at 16:59
  • 1
    #includedir /etc/sudoers.d is not a comment. It is an actual config parameter. That is why the space is missing after the hash/pound sign. see: sudo.ws/man/1.8.13/sudoers.man.html
    – spkane
    Jun 23, 2015 at 14:25
15

Looks like comma is what you need.

Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
...
user3 ALL= PRINTING

Source

Improve this answer
4
  • I have given rights the way you mentioned it however I got the error message as below. <br/>E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied) <br/> E: Unable to lock the administration directory (/var/lib/dpkg/), are you root? ... can anyone help on this?
    – Hrish
    Jan 23, 2013 at 9:17
  • @Rishee I will try once I get home
    – Karthik T
    Jan 23, 2013 at 10:03
  • my sudores file contains below mentioned things.
    – Hrish
    Jan 23, 2013 at 10:31
  • # User privilege specification root ALL=(ALL:ALL) ALL # Members of the admin group may gain root privileges %admin ALL=(ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL #includedir /etc/sudoers.d $ sudo nano /etc/sudoers %Domain_Name\\administrators ALL=(ALL) ALL %Domain_Name\\user.name ALL=NOPASSWD: /usr/bin/apt-get install, /etc/init.d/apache2 restart
    – Hrish
    Jan 23, 2013 at 10:32
5

FWIW, I was wondering the same thing as the OP, and it looks like you can as well just duplicate the lines, e.g.

user_name ALL=NOPASSWD: cmd1
user_name ALL=NOPASSWD: cmd2
user_name ALL=NOPASSWD: cmd3
Improve this answer
1
  • Thank you, this is the most readable one to me because each line represents each command. So simple.
    – Kazuya Gosho
    Feb 22 at 16:41
3

What I ended up doing was (Similar to what you are looking for):

## PRTG monitoring
Cmnd_Alias PRTG = /bin/cat /proc/loadavg, /bin/df, /var/prtg/scripts/check_proc.sh
prtg ALL = NOPASSWD: PRTG

Inside: /etc/sudoers.d/666-prtg

(666, because... well... prtg IS a windows based monitoring tool you know)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.