3

I'm trying to script the creation of a user with sudo access for my ec2 instances.

I'm having problems setting up sudo access. I'm running the following as root...

adduser --disabled-password --gecos "" testuser
usermod -a -G admin,sudo testuser

I then copy the authorized_keys from s3.

The ssh works fine at this point.

However if I try to sudo, I'm prompted for a password.

My sudoers file includes the following...

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Apart from logging out and logging back in, is there anything I need to do to actually make my changes take effect?

I didn't change the sudoers file, this was the default setup.

Also there's another system created user ubuntu, which can sudo successfully. However there is no explicit mention of this user in the sudoers file, so it must be doing it through group membership.

update: I tried adding every other group that "ubuntu" belongs to testuser, but I'm still being prompted for the password.

Is there any way I can figure out how "ubuntu" gets passwordless sudo access?

0
7

You will always be prompted for a password unless you have the NOPASSWD option set in the sudoers file for any given entry (ignoring the grace period the password is remembered and hence not prompted, default 15 minutes).

For example, to make all members of the sudo group to have passwordless sudo implementation:

%sudo   ALL=(ALL:ALL) NOPASSWD: ALL 

This indicates any member of the sudo group can run any command starting with sudo without prompting for password.

Similarly for user foobar to run the command reboot:

foobar ALL=(ALL:ALL) NOPASSWD: /sbin/reboot

Note that, it is not a good idea to have passwordless sudo access for all commands unless you have a very good reason, you should consider restricting the commands to a necessary minimum.


The sudo rules can also be defined in files under the /etc/sudoers.d/ directory, default /etc/sudoers file contains:

includedir /etc/sudoers.d

at the end, this makes any file that does not contain . or ends in ~ to be read for sudo rules. Presumably the definitions for user ubuntu defined in any of the files under the /etc/sudoes.d/ directory.

6
  • This is what I thought, but somehow the "ubuntu" user is able to do it. I'm not prompted for a password, and there is no specific entry for this user in sudoers. – user1751825 Aug 21 '16 at 2:41
  • @user1751825 Check id ubuntu – heemayl Aug 21 '16 at 2:43
  • I haven't modified the sudoers file at all. If at all possible I'd like to keep everything as standard as possible. – user1751825 Aug 21 '16 at 2:48
  • @user1751825 Check also the files in /etc/sudoers.d/ directory, its probably defined in any of those files. – heemayl Aug 21 '16 at 2:55
  • That was it. I don't know how I didn't think of that. There is a file in /etc/init.d/ that does it. – user1751825 Aug 21 '16 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.