I have a bash script which needs to perform some actions while using sudo
, both with root user permissions and permissions for other users, such as main user on a postgres database. These actions need to be performed without using a password, the main actions are to copy some files, specified by a list file, which are only accessible by root, to query whether a postgres database exists with a certain name and to take a dump from the database.
The user running the scripts is responsible for running quite a few different scripts. I understand that I can edit the /etc/sudoers
file with visudo
with a line like:
user ALL=(pg_dump_user) NOPASSWD:/usr/bin/pg_dump
or
user ALL=(pg_dump_user) NOPASSWD:/usr/bin/psql -lqt
I know that I can make the commands in the sudoers file a bit more specific, adding command options etc.
Would it be safer to call a script, which is only editable by root
and using that script in the sudoers entries. Obviously with this approach I need to ensure that the directory permissions for the script location are correct, or it can just be replaced with something malicious. Are there any other actions I can take to make this more secure?
sudo
will expect that command to be provided exactly as is, so you might have to use wildcards, and*
might open up a can of worms depending on the command. A script might make it easier for you to avoid using that wildcard, while still retaining some flexibility. But it all depends...