[SOLVED] How to allow non-root user to shutdown

Nick_C · 10-15-2014, 06:36 AM

Running "shutdown -h now" remotely returns error.

Quote:

bash: shutdown: command not found

Running "sudo shutdown -h now" remotely returns error:

Code:

sudo: sorry, you must have a tty to run sudo

"/sbin/shutdown -h now" and "/usr/sbin/shutdown -h now" both return same error:

Code:

Failed to issue method call: Access denied
Must be root

schneidz · 10-15-2014, 09:28 AM

i'm curious:

Code:

sudo /sbin/shutdown -h now
# or sudo /usr/sbin/shutdown -h now

?

also, what happens when you log in via ssh then run the commands using sudo (also try with specifying the path).

Nick_C · 10-15-2014, 11:49 AM

Quote:

Originally Posted by schneidz

i'm curious:

Code:

sudo /sbin/shutdown -h now
# or sudo /usr/sbin/shutdown -h now

?

also, what happens when you log in via ssh then run the commands using sudo (also try with specifying the path).

Logon to SSH as remoteshutdown
shutdown /h now

Code:

Authentication is required for powering off the system.
Authenticationg as: <DifferentUser>

Edit:
Have now found a way to make 'remoteshutdown' an Administrator which it was not before. This has changed things slightly, running from SSH /usr/sbin/shutdown -h now

Code:

Authentication is required for powering off the system.
Multiple identities can be used for authentication:
1 . <DifferentUser>
2 . remoteshutdown
Choose identity to authenticate as

ReaperX7 · 10-15-2014, 12:55 PM

Does your distribution use ConsoleKit or logind for session management?

Nick_C · 10-15-2014, 02:20 PM

Quote:

Originally Posted by ReaperX7

Does your distribution use ConsoleKit or logind for session management?

No idea, using CentOS 7.0

schneidz · 10-15-2014, 02:27 PM

Quote:

Originally Posted by schneidz

also, what happens when you log in via ssh then run the commands using sudo (also try with specifying the path).

i.e.-

Code:

ssh remoteshutdown@host
sudo /usr/sbin/shutdown -h now

Nick_C · 10-15-2014, 03:20 PM

Quote:

Originally Posted by schneidz

i.e.-

Code:

ssh remoteshutdown@host
sudo /usr/sbin/shutdown -h now

ssh remoteshutdown@n.n.n.n

Code:

The authenticity of host 'n.n.n.n' can't be established.  ECDSA key fingerprint is ...... Are you sure you want to continue connecting (yes/no)?  Answer 'yes'

now logs-in ok

sudo /usr/sbin/shutdown -h now
Shuts-down server ok

Run batch file
plink.exe -ssh -pw <password> remoteshutdown@n.n.n.n "/sbin/shutdown -h now"
Error:

Code:

Failed to issue method call: Access denied
Must be root.

schneidz · 10-15-2014, 03:27 PM

Quote:

Originally Posted by Nick_C

ssh remoteshutdown@n.n.n.n
The authenticity of host 'n.n.n.n' can't be established. ECDSA key fingerprint is ...... Are you sure you want to continue connecting (yes/no)? Answer 'yes'
now logs-in ok

sudo /usr/sbin/shutdown -h now
Shuts-down server ok

good so you added permission for remoteshutdown to run that command via visudo (did it prompt for a password ?).

so now are you trying to make it so that remoteshutdown can shutdown the server via something like:

Code:

ssh remoteshutdown@n.n.n.n sudo /usr/sbin/shutdown -h now

i think sudo requires someone to be logged in for security reasons (there may be a way to disable that) ?

Nick_C · 10-15-2014, 03:33 PM

Quote:

Originally Posted by schneidz

i think sudo requires someone to be logged in for security reasons (there may be a way to disable that) ?

Which is why I was not sure that sudo is the correct way of doing this, I had hoped that there would have been a simpler way of doing this like changing the group on the shutdown command or something like that.

schneidz · 10-15-2014, 03:58 PM

that mite work. what does

Code:

which shutdown
ll /sbin/shutdown /usr/sbin/shutdown

look like ?

Nick_C · 10-16-2014, 09:37 AM

Quote:

Originally Posted by schneidz

that mite work. what does

Code:

which shutdown
ll /sbin/shutdown /usr/sbin/shutdown

look like ?

which shutdown

Code:

/usr/sbin/shutdown

ll /sbin/shutdown /usr/sbin/shutdown

Code:

lrwxrwxrwx. 1 root root 16 Sep 25 16:11 /sbin/shutdown -> ../bin/systemctl
lrwxrwxrwx. 1 root root 16 Sep 25 16:11 /usr/sbin/shutdown -> ../bin/systemctl

Does that help

schneidz · 10-16-2014, 09:40 AM

i would be concerned with changing permissions on the systemctl program becuz then remoteshutdown would be allowed to do other things like restart sshd, httpd, mysqld, ...

schneidz · 10-16-2014, 09:50 AM

this mite help:
http://maymay.net/blog/2010/03/17/ho...cing-security/

Nick_C · 10-16-2014, 10:20 AM

Code:

chmod +s /sbin/shutdown

then plink line works fine without any of this sudoers complication

Code:

plink.exe -ssh -pw <password> remoteshutdown@n.n.n.n "/sbin/shutdown -h now"

Simples

Thanks for all your help with this

schneidz · 10-16-2014, 10:27 AM

thanks for sharing your solution. my suggestion would be to use keys instead of writing down the passwd.

if it is solved please select resolved under thread tools.