248

I would like to run a script from the main ubuntu shell as a different user that has no password.

I have full sudo privileges, so I tried this:

sudo su -c "Your command right here" -s /bin/sh otheruser

Then I have to enter my password, but I am not sure if that script is now really running under that user.

How can I confirm that the script is really running under that user now?

356

You can do that with su or sudo, no need for both.

sudo -H -u otheruser bash -c 'echo "I am $USER, with uid $UID"' 

The relevant parts of man sudo:

-H   The -H (HOME) option requests that the security policy set
     the HOME environment variable to the home directory of the
     target user (root by default) as specified by the password
     database.  Depending on the policy, this may be the default
     behavior.
-u user     The -u (user) option causes sudo to run the specified
      command as a user other than root.  To specify a uid
      instead of a user name, use #uid.  When running commands as
      a uid, many shells require that the '#' be escaped with a
      backslash ('\').  Security policies may restrict uids to
      those listed in the password database.  The sudoers policy
      allows uids that are not in the password database as long
      as the targetpw option is not set.  Other security policies
      may not support this.

su can only switch user without providing a password if you are root. See Caleb's answer

You can modify the /etc/pam.d/su file to allow su without password. See this answer.

If you modified your auth file to the following, any user that was part of group somegroup could su to otheruser without a password.

auth       sufficient pam_rootok.so
auth       [success=ignore default=1] pam_succeed_if.so user = otheruser
auth       sufficient   pam_succeed_if.so use_uid user ingroup somegroup

Then test from terminal

rubo77@local$ su otheruser -c 'echo "hello from $USER"'
hello from otheruser
  • 4
    Can you please add how to do it with just su too? – rubo77 Oct 6 '14 at 12:33
  • 2
    This asks me for a password :-( – IanVaughan Jul 20 '15 at 12:39
  • 1
    @IanVaughan, With default configuration (of sudo), you will get asked for a password unless you run it as root. You can configure sudo to "allow user A to run cmd C as user B without requiring a password". See help.ubuntu.com/community/Sudoers – geirha Jul 21 '15 at 12:54
  • 1
    I'm prompted for a password when running this as root. Any suggestions? – Nate Nov 28 '15 at 0:26
  • 1
    @NamGVU keep in mind that order matters. If your sudoers has a rule further down that sets other permissions for your user, or a group you're a member of, that will override your NOPASSWD rule. – geirha Mar 28 at 7:12
100

If you want to use su instead of sudo, I believe you can use something like this:

su - <username> -c "<commands>"
  • - will simulate a login of the specified user
  • -c tells it that you want to run a command

ps. Unfortunately I'm not able to install ruby using rvm with this method, but that's probably not related.

  • 5
    I needed to add sudo to the beginning otherwise it asked me for my password. – IanVaughan Jul 20 '15 at 12:42
  • 2
    This definitely doesn't work without sudo. with sudo it works, for example: sudo su - www-data -c "touch /tmp/test"successfully created a file as www-data – rubo77 Sep 24 '16 at 8:41
  • To use "su" you need the root password, the point of "sudo" is to avoid that. If you have the root password using "su" as above should work fine. – Samuel Åslund Jun 30 '17 at 7:51
6

The answers above are really useful to me but to answer the actual question...

How can I affirm that the script is really running under that user now?-

Use:

ps -ef | grep <command-name>

The output should include your script and the actual user executing it. People on BSD-like systems, e.g. MAC can find similar information with:

ps aux | grep <command-name>
  • Linux users can use ps aux. – Dean Howell Sep 20 '18 at 20:08
  • @DeanHowell; True, but MAC users can not use "ps -ef" and the "ps aux" is BSD options, only available as a compatibility feature while the "ps -ef" is standardized Unix/POSIX options. – Samuel Åslund Sep 22 '18 at 10:26
2

I had the same problem. Just type in the command screen -dmS testscreen this will create a detached screen on your non-sudo user account and then you can log it and check if this screen is there by screen -ls.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.