Permissions to execute commands as another user

mf370 · 06-01-2017, 07:31 AM

I installed a program named IntelMQ, here it is all the steps that I made to install it in a CentOS 7https://github.com/certtools/intelmq/issues/981. During the installation two users are created: intelmq and apache.
The user apache is part of the GUI of the IntelMQ program and it has to execute commands as the user intelmq.
Basically, I can start the IntelMQ bots on the GUI, however I can't stop them. Probably is due to permission problems.

In the command line if I try to execute this command as the user apache it returns this:

Command:

Code:

sudo -u apache sudo -u intelmq /usr/bin/intelmqctl --type json stop abusech-domain-parser

Output:

Code:

Sorry, user apache is not allowed to execute '/bin/sudo -u intelmq /usr/bin/intelmqctl --type json stop abusech-domain-parser' as apache on localhost.localdomain

I'm very new to CentOS.

pan64 · 06-01-2017, 07:53 AM

I do not really understand why do you need double sudo.
Probably it can work without sudo -u apache too.
Also it is not related to centos at all.
I do not really know which user is allowed to execute /usr/bin/intelmqctl.
Finally I think you need to configure the sudoers, see visudo

mf370 · 06-01-2017, 09:12 AM

I already configured the sudoers file through visudo and that didn't solve my problem. I know this issue is not 100% related to CentOS, but in IntelMQ GitHub they weren't able to help me, because they are not familiarized with this OS.

Turbocapitalist · 06-01-2017, 10:09 AM

It's still not an OS issue but one of configuring /etc/sudoers properly. Why does it have to be just the account "apache" that should be able to launch /usr/bin/intelmqctl as as the account "intelmq" ?

Can you show what line you added to /etc/sudoers?

mf370 · 06-01-2017, 10:16 AM

The user apache gives access to the web interface of intelmq, and to execute any commands in the web interface, apache needs to run them as the user intelmq.

I added this line to the sudoers file: apache ALL=(intelmq) NOPASSWD: /usr/bin/intelmqctl

Is there a possibility that maybe my sudo is broken, and maybe that's why I can't execute the commands?

I'm really sorry to bother you guys with a subject that is not related to the OS 100%, but I don't know anywhere else to ask help.

Turbocapitalist · 06-01-2017, 10:37 AM

Quote:

Originally Posted by mf370

I added this line to the sudoers file: apache ALL=(intelmq) NOPASSWD: /usr/bin/intelmqctl

Close. If it "apache" that you will have run sudo then /etc/sudoers needs to be set to allow that. However, be very precise with the options:

Code:

apache ALL=(intelmq:intelmq) NOPASSWD: /usr/bin/sudo -u intelmq /usr/bin/intelmqctl --type json stop abusech-domain-parser

See either of the following to get up to speed on configuring sudo

sudo: You're Doing It Wrong (slides)
sudo: You're Doing It Wrong (video)

mf370 · 06-01-2017, 10:48 AM

Quote:

apache ALL=(intelmq:intelmq) NOPASSWD: /usr/bin/sudo -u intelmq /usr/bin/intelmqctl --type json stop abusech-domain-parser

This line in the /etc/sudoers raises a JSON error in IntelMQ's web interface...

Anyway, thank you very much for your help. I will try to talk again with the IntelMQ team, because this is something related to the program and not the OS itself.

Once again, thank you!

Turbocapitalist · 06-01-2017, 10:57 AM

Quote:

Originally Posted by mf370

This line in the /etc/sudoers raises a JSON error in IntelMQ's web interface...

Does it work manually from the shell?

Quote:

Originally Posted by mf370

Anyway, thank you very much for your help. I will try to talk again with the IntelMQ team, because this is something related to the program and not the OS itself.

Once again, thank you!

There's a server subforum here. I think that's what was being referred to.

mf370 · 06-01-2017, 11:01 AM

Yes, it does work from the shell.

Quote:

There's a server subforum here. I think that's what was being referred to.

Alright I'll take a look on that subforum, thank you!

pan64 · 06-01-2017, 11:28 AM

so it works from shell. That means it is an issue with this sudoers, not with the application. /etc/sudoers itself cannot raise any json error.