I need to enable NOPASSWD for one user across 60+ hosts. I've only ever enabled it manually, using visudo. Is there a way to script this? I can easily log into all hosts as root, but I'm not sure if there is a command I can run to automatically add someone to the sudoers file with the NOPASSWD flag
Create a file with the required NOPASSWD line and drop it into /etc/sudoers.d. To verify the correctness of the file, use visudo to create it:
visudo -f some-file
cp some-file /etc/sudoers.d/
Then use scp or whatever means of control you use to send the files to the target systems.
sudoers.d files are read in lexicographic order, so use some numbering like 00-something, 99-most-important, etc. (like in /etc/grub.d/) to make ordering easier.
-
This is perfect, happy to accept when I'm allowed. Any idea what I could do if the user already exists in
/etc/sudoerswithout the NOPASSWD flag (which causes them to be prompted because they have two rules, one which does not have NOPASSWD)? – Hamy Oct 14 '14 at 19:48 -
Ugh, looks like I may have to use nasty hacks or just manually remove the incorrect line, as it was appended to the file after sudoers.d is loaded – Hamy Oct 14 '14 at 19:53
-
@Hamy the last applicable entry is used by
sudo, and usually the last entry in/etc/sudoersis#includedir /etc/sudoers.d, so files in that directory are read after entries insudoers. So the entries in files insudoers.dtake precedence over those insudoers. – muru Oct 14 '14 at 19:53 -
Yup. Guess this has become a learning opportunity lol. Lesson is "use external files in sudoers.d when you need to add stuff programmatically" – Hamy Oct 14 '14 at 19:55
-
1@Hamy also note that
sudoers.dfiles are read in lexicographic order, so use some numbering like00-something,99-most-important, etc. (like/etc/grub.d/) to make ordering easier. – muru Oct 14 '14 at 19:59
