1

I need to enable NOPASSWD for one user across 60+ hosts. I've only ever enabled it manually, using visudo. Is there a way to script this? I can easily log into all hosts as root, but I'm not sure if there is a command I can run to automatically add someone to the sudoers file with the NOPASSWD flag

3

Create a file with the required NOPASSWD line and drop it into /etc/sudoers.d. To verify the correctness of the file, use visudo to create it:

visudo -f some-file
cp some-file /etc/sudoers.d/

Then use scp or whatever means of control you use to send the files to the target systems.

sudoers.d files are read in lexicographic order, so use some numbering like 00-something, 99-most-important, etc. (like in /etc/grub.d/) to make ordering easier.

  • This is perfect, happy to accept when I'm allowed. Any idea what I could do if the user already exists in /etc/sudoers without the NOPASSWD flag (which causes them to be prompted because they have two rules, one which does not have NOPASSWD)? – Hamy Oct 14 '14 at 19:48
  • Ugh, looks like I may have to use nasty hacks or just manually remove the incorrect line, as it was appended to the file after sudoers.d is loaded – Hamy Oct 14 '14 at 19:53
  • @Hamy the last applicable entry is used by sudo, and usually the last entry in /etc/sudoers is #includedir /etc/sudoers.d, so files in that directory are read after entries in sudoers. So the entries in files in sudoers.d take precedence over those in sudoers. – muru Oct 14 '14 at 19:53
  • Yup. Guess this has become a learning opportunity lol. Lesson is "use external files in sudoers.d when you need to add stuff programmatically" – Hamy Oct 14 '14 at 19:55
  • 1
    @Hamy also note that sudoers.d files are read in lexicographic order, so use some numbering like 00-something, 99-most-important, etc. (like /etc/grub.d/) to make ordering easier. – muru Oct 14 '14 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.