0

background

I got hold of an ubuntu box on AWS, and I was following the instructions to install a mattermost server. Things were going smooth until I reached this part:

For the purposes of this guide we will assume this server has an IP address of 10.10.10.2 (note: i'm using local host instead ie 127.0.0.0)

  1. Create a user and group for running mattermost:

sudo useradd --create-home --user-group --system mattermost

  1. Change to the account of the new user:

sudo --user=mattermost --shell

  1. Change into the home of the new user:

cd

Download any version of the Mattermost Server by typing:

wget https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz

The last link should be replaced by this one

https://releases.mattermost.com/3.6.0/mattermost-team-3.6.0-linux-amd64.tar.gz

which naturally can be easily downloaded from chrome.

problem

When I try to download that file from CLI:

wget https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz

I get the following:

--2017-01-17 07:22:36-- https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz Resolving releases.mattermost.com (releases.mattermost.com)... 54.192.192.48, 54.192.192.69, 54.192.192.118, ... Connecting to releases.mattermost.com (releases.mattermost.com)|54.192.192.48|:443... connected. HTTP request sent, awaiting response... 403 Forbidden 2017-01-17 07:22:36 ERROR 403: Forbidden.

what I have tried

At this point I obviously don't have a password for the user mattermost.. so I exit the shell and give them a password:

$ sudo passwd mattermost
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

but then when I jump back to the mattermost shell and try to be a wise guy:

$ sudo wget https://releases.mattermost.com/3.6.0/mattermost-team-3.6.0-linux-amd64.tar.gz
[sudo] password for mattermost:
mattermost is not in the sudoers file.  This incident will be reported.

So i'm not exactly sure what to do here. Why do I need to be sudo to download a publicly available file anyways?

note: i just realized that the same error happens even if i'm root on that aws box

  • 2
    You can download the file as any user, just make sure the directory is writable by the user. For example, do: wget -P /tmp https://releases.mattermost.com/3.6.0/mattermost-team-3.6.0-linux-amd64.tar.gz to save in /tmp/. Also every user has write permission on his/her home, perhaps you are running from a directory that the user does not have permission to write on. – heemayl Jan 17 '17 at 8:02
3

You have two unrelated problems.

"403 Forbidden" is a web server error. You have to fix your URL.

When you ran wget https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz, you got a 403: Forbidden error. This is an error from the web server and is unrelated to the user account used to download the file.

When you attempt to load a page or download a file and you specify an incorrect URL, a 404: Not Found errors is the most common result. But a 403 error can occur sometimes in this situation, and that appears to be what is happening here. It looks, from both the command you ran and wget's output, like you forgot to put the actual version numbers in the URL.

On my system, I am able to get exactly the same error using the URL with X.X.X instead of an actual version number:

ek@Io:~/Downloads$ wget https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz
--2017-01-17 03:15:30--  https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz
Resolving releases.mattermost.com (releases.mattermost.com)... 54.192.147.30, 54.192.147.18, 54.192.147.46, ...
Connecting to releases.mattermost.com (releases.mattermost.com)|54.192.147.30|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2017-01-17 03:15:32 ERROR 403: Forbidden.

And if I use the correct URL, it works:

ek@Io:~/Downloads$ wget https://releases.mattermost.com/3.6.0/mattermost-team-3.6.0-linux-amd64.tar.gz
--2017-01-17 03:09:50--  https://releases.mattermost.com/3.6.0/mattermost-team-3.6.0-linux-amd64.tar.gz
Resolving releases.mattermost.com (releases.mattermost.com)... 54.192.147.156, 54.192.147.30, 54.192.147.160, ...
Connecting to releases.mattermost.com (releases.mattermost.com)|54.192.147.156|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 27221349 (26M) [application/x-gzip]
Saving to: ‘mattermost-team-3.6.0-linux-amd64.tar.gz’

mattermost-team-3.6.0-linux- 100%[==============================================>]  25.96M   106KB/s    in 2m 6s

2017-01-17 03:11:58 (212 KB/s) - ‘mattermost-team-3.6.0-linux-amd64.tar.gz’ saved [27221349/27221349]

(Both the working and non-working URLs are from your post. I don't actually know exactly what file you need.)

The mattermost user isn't a sudoer.

Not all users may run programs as root (or at all) with the sudo command. The file /etc/sudoers, or a file in /etc/sudoers.d, must be configured to allow them to do so. Most commonly, this is achieved by putting the user in a group that one of those files permits to run commands.

In particular, to make a user an administrator on an Ubuntu system so that they are permitted to run any command as root using sudo, add the user to the sudo group:

sudo usermod -aG sudo mattermost

Of course, you must run that as a user who can run commands as root with sudo already. (You were able to run sudo passwd mattermost, so I know you have at least one such user.)

Keep in mind:

  • You must only do this if you really want that user to have full power to do anything. They will have the same power as you. Once you've decided you want that, though, you should go ahead and simply add the user to the sudoers group. There is usually no need to actually edit any configuration files for sudo -- they're already set up to recognize the sudo group as conferring administrative power.
  • If for some reason you instead choose to edit /etc/sudoers or create/edit a file in /etc/sudoers.d, it is important that you use the visudo utility to do it, because it performs a syntax check to make sure your changes will be understood by sudo. If sudo sees incorrect syntax in a sudoers file, then it will completely refuse to work. For servers you only have remote access to, this can lock you out of the system.

Finally, it's very rare that you actually have to manually download a file with wget as root. In this case, you didn't -- the error was an incorrect URL and the "forbidden" message was from the web server. Therefore:

  • If this is the only reason mattermost needed to use sudo, you probably shouldn't give that user account these abilities, because there's no need.
  • Even if mattermost really does need to be an administrator, they should perform actions as themselves (without sudo) rather than as root (with sudo) except when there is a clear reason to do the latter.
0

This is actually two separate errors:

  1. The wget command is not on your side but server-side, i.e. you don’t have access to that file on the web server (the 403 means that the client is denied acces). Now when I test wget https://releases.mattermost.com/3.6.0/mattermost-team-3.6.0-linux-amd64.tar.gz it works, som maybe it was just some temporary thing. But still, a 403 error is that the server does not allow you to access the url.

  2. The sudo issue is a completely different story. When you install Ubuntu you create a user during the installation process. That user is the only one able to sudo, until you give access to other users. To give a specific user access to the sudo command you have to run the visudo command as root, i.e. sudo visudo, and edit the file correspondingly. Some examples of how to give specific users access can be found here.

  • Ah, Eliah beat me to it, and his answer is more thourough. – Simon Arons Jan 17 '17 at 8:44
  • That's okay -- the information is presented somewhat differently in each of our answers, and there's value in brevity, so I think this answer is helpful. – Eliah Kagan Jan 17 '17 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.