Sudo without Password

dfn · 09-26-2015, 12:06 PM

I have two scripts I added to a shell script. I can manually run the scripts from the prompt line and the process works. But, I get prompted for a password.

When I execute the code in the shell script I get the following error messages:

cleanwork is not found saswork file does not exist

cleanwork is a program and not a directory. When cleanwork is executed it kills orphanes in the sasworks directory. To run cleanworks program the sudo command is used.

cleanwork program path is as follow:

/sasem/sas94/sashome/sasfoundation/9.4/utilities/bin

sasworks - is a directory and path is:
/sasworks

1. The first part of the code is the syntax for NOPASSWORD when executing cleanwork.

2. The second part of code is a variable containing the path to the cleanwork program and to saswork directory

3. finally each variable is executed.

Code:

!#/bin/bash

sasadm ALL = NOPASSWD: ALL

echo cleanwork='/usr/bin/sudo   /sasem/sas92/sashome/sasfoundation/9.2/utilities/bin/cleanwork /sasworks'


echo cleanwork94='/usr/bin/sudo   /sasem/sas94/sashome/sasfoundation/9.4/utilities/bin/cleanwork /sasworks'

./$cleanwork

./$cleanwork94

Rinndalir · 09-26-2015, 12:32 PM

I am not sure what the question is.

What does

Code:

file /sasem/sas92/sashome/sasfoundation/9.2/utilities/bin/cleanwork
file /sasem/sas94/sashome/sasfoundation/9.4/utilities/bin/cleanwork
ls -l /sasem/sas92/sashome/sasfoundation/9.2/utilities/bin/cleanwork
ls -l /sasem/sas94/sashome/sasfoundation/9.4/utilities/bin/cleanwork

tell you?

John VV · 09-26-2015, 12:58 PM

you do know that calling "sudo" requires that users password be typed in
-- this is how sudo works

and setting "nopassword" is normally a very bad idea .

jmgibson1981 · 09-26-2015, 05:42 PM

Global NOPASSWD is a horrible idea, defeats the purpose. But setting it for a single script, nothing wrong with that. It's how I have my laptop and server keep themselves updated.

dfn · 09-26-2015, 07:14 PM

Quote:

Originally Posted by jmgibson1981

Global NOPASSWD is a horrible idea, defeats the purpose. But setting it for a single script, nothing wrong with that. It's how I have my laptop and server keep themselves updated.

How do I set NOPASSW in my script?

Code:

!#/bin/bash

sasadm ALL = NOPASSWD: ALL
echo cleanwork='/usr/bin/sudo   /sasem/sas92/sashome/sasfoundation/9.2/utilities/bin/cleanwork /sasworks'


echo cleanwork94='/usr/bin/sudo   /sasem/sas94/sashome/sasfoundation/9.4/utilities/bin/cleanwork /sasworks'

./$cleanwork


./$cleanwork94

jmgibson1981 · 09-26-2015, 08:08 PM

Code:

username hostname =NOPASSWD:/path/to/script

or in my case

Code:

jason failbox =NOPASSWD:/data/jason/bin/mymanager

I have this in a file under my /etc/sudoers.d directory. can name it anything you want but you must get the syntax perfect or you can lock yourself out of sudo. at that point you need to boot a live disk and remove or fix the offending line. This allows that script and ONLY that script to run as sudo without a password. If you have the time to work on it, I highly suggest you make a VirtualBox of a basic command line Ubuntu server or something to test and play with this before you do it on something in production. Like I said, if you have the smallest typo, you are locked out of sudo.

You have been warned

chrism01 · 09-27-2015, 09:42 PM

As pointed out above, you can't add access in a bash script; it has to be done in the /etc/sudoers file (use visudo - this will check your syntax), or create a properly formatted(!!) sudoers type file in the /etc/sudoers.d dir.

As above also, NOPASSWD is really dangerous.

suicidaleggroll · 09-27-2015, 10:17 PM

Quote:

Originally Posted by jmgibson1981

Global NOPASSWD is a horrible idea, defeats the purpose. But setting it for a single script, nothing wrong with that. It's how I have my laptop and server keep themselves updated.

If the user has write permission to that script or the directory it lives in, it makes no difference. The script can just be modified or replaced with anything. Might as well set a global NOPASSWD, it's the same thing. That's why it's such a bad idea to use it at all, SO EASY to bypass.

If you want to run something as root automatically on a schedule, then just do it the right way. Enable the root account, give it a strong password, and run whatever root commands you need in root's cron. NOPASSWD sudo is a terrible workaround.

jmgibson1981 · 09-28-2015, 08:57 AM

Thats why only admin has write ability to script.

suicidaleggroll · 09-28-2015, 10:08 AM

Quote:

Originally Posted by jmgibson1981

Thats why only admin has write ability to script.

The same "admin" who can execute that script as root via sudo without a password, or is this some other user? What about the directory containing that script, or the directory containing that directory?

jmgibson1981 · 09-28-2015, 10:50 AM

What if what if what if. My family is my wife and myself. It may not be perfect for the Enterprise but that is none of my concern. For home use it is a perfectly acceptable solution. Anybody could "what if" until they are blue in the face. What if a plane falls on your house and kills you? How far does it go?

For what it's worth though, I keep my system scripts in a secure folder where no one can write to them except me. They can read them just fine, and execute if I give them the ability, but no one can write to my system scripts directory. There are probably better ways to do it but it works for me. I never claimed nor am I trying to execute and learn "best practices". I just do what works, quick and dirty sometimes.

*EDIT* In the end it turns out it is pointless anyway as simply doing

Code:

sudo crontab -e

does the job. So we learned something. No need to activate root.