Sudeors File Not Working

devUnix · 12-13-2013, 05:27 PM

I have this sudoer file /etc/sudoers.d/ux-cds-production-support

It has permission of 0440 and the contents are given here:

Code:

%UX-CDS-Production-Support.GG ALL=NOPASSWD:/bin/ls
%UX-CDS-Production-Support.GG ALL=NOPASSWD:/usr/bin/less
%UX-CDS-Production-Support.GG ALL=NOPASSWD:su /usr/sbin/lsof -v
%UX-CDS-Production-Support.GG ALL=NOPASSWD:su - tomcat /usr/bin/jstack
%UX-CDS-Production-Support.GG ALL=NOPASSWD:su - tomcat /usr/bin/jstat
%UX-CDS-Production-Support.GG ALL=NOPASSWD:su - tomcat /usr/bin/jstatd
%UX-CDS-Production-Support.GG ALL=NOPASSWD:su - tomcat /usr/bin/jmap

When I run any of the sudo commands as a user who is in the said group, I get these errors:

Code:

...
...
>>> /etc/sudoers.d/ux-cds-production-support: syntax error near line 5 <<<
>>> /etc/sudoers.d/ux-cds-production-support: syntax error near line 6 <<<
sudo: parse error in /etc/sudoers.d/ux-cds-production-support near line 2
sudo: no valid sudoers sources found, quitting

I have tried it on some other server and the same errors are appearing.

What could be wrong?

/etc/security/access.conf has got the entry for the said group.

TobiSGD · 12-13-2013, 05:42 PM

Your file has syntax errors, which indicates that you have not edited it with visudo, as is recommended. Also, your su syntax is totally borked. Not that it would be needed at all here, since you are already using sudo.

Try it with this file:

Code:

%UX-CDS-Production-Support.GG ALL=NOPASSWD: /bin/ls
%UX-CDS-Production-Support.GG ALL=NOPASSWD: /usr/bin/less
%UX-CDS-Production-Support.GG ALL=NOPASSWD: /usr/sbin/lsof -v
%UX-CDS-Production-Support.GG ALL=(tomcat)NOPASSWD: /usr/bin/jstack
%UX-CDS-Production-Support.GG ALL=(tomcat)NOPASSWD: /usr/bin/jstat
%UX-CDS-Production-Support.GG ALL=(tomcat)NOPASSWD: /usr/bin/jstatd
%UX-CDS-Production-Support.GG ALL=(tomcat)NOPASSWD: /usr/bin/jmap

For the commands that have to run as user tomcat (I just guessed that that is what you wanted to do there) in a login shell you will have to use the -u and -i options, like this:

Code:

sudo -i -u tomcat /usr/bin/jstack

I strongly recommend to read the man pages for sudo, sudoers and su, since these commands are very critical to your systems security.