restrict sudoers by envirnmoent

bardinjw · 07-28-2006, 09:24 AM

Can someone think of a way to do this with sudoers?

I want sudo to not ask for a password (easy), but only if I'm connected via ssh (not so easy).

Is there someway to check for an environment variable? I could use the existence of SSH_CONNECTION to verify it, and even better, restrict this behavior to when I'm connecting from a specified subnet.

acid_kewpie · 07-30-2006, 03:22 AM

i would expect that whatever you want to achieve could be handled via the standard format of the sudoers file. you can easily define arbitrary ip sourcs and netblocks to control this. insofar as comparing ssh to other access forms, i wuld suggest that the only remote access to a shell you have is ssh anyway? inwhich case it is reduced to just a network based connection. check the sudoers manpage for details of defining network objects.