0

I have to write a script and it requires root privileges to execute some linux commnads and to stop & start some services. I'm asked to disable sudo access totally for all the users (as the normal users can gain access to root with the command 'sudo -s') and I did it. So I'm looking for the script to automate the switch user password(su) which does not need user intervention.

EDIT:1

On further research I got following script what I'm in need of:

#!/usr/bin/python
import pexpect
import os
passwd = "my-root-password-here"
child = pexpect.spawn('su root')
child.expect('Password:')
child.sendline(passwd)
child.expect('$')
child.interact()

I have checked this script executing manually logging in as normal user and it switched to root without any problem. But when I type exit/ctrl+d to switch back to the normal user, I'm getting following error:

Traceback (most recent call last):
 File "./su3.py", line 9, in <module>
  child.interact()
File "/usr/lib/python2.6/dist-packages/pexpect.py", line 1492, in interact
  self.__interact_copy(escape_character, input_filter, output_filter)
File "/usr/lib/python2.6/dist-packages/pexpect.py", line 1520, in __interact_copy
  data = self.__interact_read(self.child_fd)
File "/usr/lib/python2.6/dist-packages/pexpect.py", line 1510, in __interact_read
  return os.read(fd, 1000)
OSError: [Errno 5] Input/output error

any help...

Improve this question
0

3 Answers 3

Reset to default
3

Users cannot run sudo -s if they don't have permissions to run whatever the SHELL is.

What you want is to have your users tell you exactly what commands they want to be able to run. Be especially careful that any commands they want to run are owned by root so they can't replace them with something that elevates their privileges later.

If they want to be able to run ifconfig for instance,

%netadmins ALL=(ALL) NOPASSWD: /sbin/ifconfig

Try that, and you'll see that the netadmins group can only run /sbin/ifconfig with no password entered as root.

Improve this answer
1
  • Thanks a lot for sharing your knowledge and it will be useful for many!
    – user3215
    Jan 31, 2011 at 16:05
2

If you need to run that script as a non-root user, you should configure sudo to allow that. You can configure sudo per user or group to allow all or only certain commands, either with or without password. Completely disabling sudo for all users is probably not what you want...

Improve this answer
2
  • As the users can easily gain access to root simply entering their own password with the command 'sudo -s', I had to disable sudo completely. I have tried some scripts but that didn't work for me.
    – user3215
    Oct 28, 2010 at 9:16
  • 1
    sudo -s only works if you allow it (e.g. on Ubuntu, it's allowed for all users that are members of the ‘admin’ group, but not for other users). You should read the sudo & sudoers & visudo documentation to learn more about this. I need some sleep before providing you examples though... ;-)
    – JanC
    Oct 28, 2010 at 11:06
0

You could set the execute sticky bit on that script so that it will always execute as the owner of the script. Something like chmod 4750 script_name

Expect can be used to automate responses in a script. Be careful with either of these as they can introduce security risks, especially when giving regular users elevated privileges.

Properly configuring sudo, instead of disabling it completely, as JanC stated, is probably the best solution.

Improve this answer
6
  • Having assigned the sticky bit still says "You need root privileges to run this script". Yes, I'm looking for the expect script but I can't do myself as I'm poor at programming.
    – user3215
    Oct 28, 2010 at 10:07
  • Is the script owned by root? Setting the sticky bit as above will execute as the script owner. There are many expect examples online. Try Expect Examples.
    – hannaman
    Oct 28, 2010 at 10:36
  • 1
    The "sticky" bit does not control what user an executable runs as. In normal files, it basically does nothing (it was an old unix trick to get a file to "stick" in RAM). On directories, it does cause the permissions to work a bit differently, so that even if you have write access, you can only rename and delete your own files. This is for temp directories.
    – SpamapS
    Nov 3, 2010 at 18:51
  • What you probably meant was the setuid bit. This would work if his script were an actual binary executable, but this does not work on scripts.
    – SpamapS
    Nov 3, 2010 at 18:51
  • -1 The setuid bit does not work for shell scripts
    – João Pinto
    Nov 3, 2010 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .