0

I have a deployment script that gets executed by an unprivileged deploy user. To fully automate things, though, I have to write a web server configuration file to /etc/nginx/sites-available and symlink it in /etc/nginx/sites-enabled.

I'd rather not change ownership or permissions for this particular directory so I've been trying to figure out a way to do this with password-less sudo access. Since I'm here, I guess it's pretty clear that I haven't had any luck.

Is there any way to update my sudoers file such that the deploy user can write new files to those directories?

Improve this question

1 Answer 1

Reset to default
1

You can try writing a NOPASSWD rule like so:

deploy ALL = (root) NOPASSWD: /bin/cp -t /etc/nginx/sites-available *, /bin/ln -s /etc/nginx/sites-available/* /etc/nginx/sites-enabled

Then the deploy use would directly copy to the sites-available folder, after creating the configuration elsewhere, then create the link (without a target name being specified).

This might have loopholes too.

Or you could write a script that manages all this, and have a single NOPASSWD rule with only that script.

Improve this answer
6
  • This is similar to what I've been trying, but I'll play with it. You have some syntax in here that I definitely haven't tried. This is a staging server, so I'm not overly concerned about security--I just want to avoid doing anything ridiculously open. Thanks for your help.
    – Rob Wilkerson
    Mar 3, 2015 at 16:32
  • @RobWilkerson A single site configuration file can have multiple server definitions, so the simplest way maybe to create (and link) a file (say /etc/nginx/sites-available/deploy.conf), and give deploy write access to that file only (using chown + chmod).
    – muru
    Mar 3, 2015 at 16:36
  • yeah, but that's against our convention (1 conf file per project/site) and it means automated appends to a file that could get huge. I'd really like to keep this within our existing standards even though it's hard. Hopefully it's not actually impossible.
    – Rob Wilkerson
    Mar 3, 2015 at 16:47
  • 2 things with your syntax: 1. I'm getting prompted for a password, and 2. even after entering it, permission is still denied. As deploy, have created a file in my home and tried to mv/cp it to /etc/nginx/sites-available. Did I miss something?
    – Rob Wilkerson
    Mar 3, 2015 at 16:53
  • What was the exact command you used?
    – muru
    Mar 3, 2015 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .