HowTO: Sudoers Configuration

[ibuclaw]

i get /bin/mount ; acrane1 ; and Crane3

Well, I get no problems using that combination, I would say that that may be because I use an upstream version of sudo, but I have my doubts.

Does it work when you tried out what was originally suggested to you?

Cmnd_Alias MYCMD=/bin/mount
acrane1 ALL=NOPASSWD: MYCMD

Also, what type of script are you using, and how are you running it?

Regards
Iain

[acrane1]

No it doesn't work with the originally suggested code. The script section is
#!/bin/sh
sudo mount /dev/sdf1 /media/Xtreme\ Drive
sudo mount /dev/sdc1 /media/Barracuda

The script works, it is being used as a start up script. When I run the script I am prompted for a password, once I type it in then they mount.

So from what I've shown you, my visudo file looks correct? and it should be working?

[ibuclaw]

No it doesn't work with the originally suggested code. The script section is
#!/bin/sh
sudo mount /dev/sdf1 /media/Xtreme\ Drive
sudo mount /dev/sdc1 /media/Barracuda

The script works, it is being used as a start up script. When I run the script I am prompted for a password, once I type it in then they mount.

So from what I've shown you, my visudo file looks correct? and it should be working?

There should be no issue whatsoever.

Just ensure that the path is /bin/mount and the line that grants you permissions to execute it without a password is at the very bottom of the configuration file, and that should be it.

If you are certain that everything is right, post the output of:

sudo -l

if you are still having problems.

Regards
Iain

[acrane1]

I get
User acrane1 may run the following commands on this host:
(ALL) ALL

[ibuclaw]

hmmm... that is definitely not set then.
only one way to find out for sure what is going on.

sudo cat /etc/sudoers

Regards
Iain

[acrane1]

I edited my visudo to
# Uncomment to allow members of group sudo to not need a password
# %sudo ALL=NOPASSWD: ALL

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root ALL=(ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
acrane1 ALL=NOPASSWD:/bin/umount
acrane1 ALL=NOPASSWD:/bin/mount

now sudo -l outputs

User acrane1 may run the following commands on this host:
(ALL) ALL
(root) NOPASSWD: /bin/umount
(root) NOPASSWD: /bin/mount

It is now working. Thanks for all your help

[ibuclaw]

Heh, thanks.

I suppose you ultimately figured it out yourself though, and that is what counts.

[rduke15]

Is it possible to restrict commands to specific paths?

I am looking for a way to allow users to chown and chmod certain files and directories, IF they are under a specific directory.

For example:

sudo chown -R -c :webmasters /docs/www

should be allowed. But NOT other directories like

sudo chown -R -c :users /etc

Is this possible with sudo?

Thanks.

[ibuclaw]

Is it possible to restrict commands to specific paths?

I am looking for a way to allow users to chown and chmod certain files and directories, IF they are under a specific directory.

For example:

sudo chown -R -c :webmasters /docs/www

should be allowed. But NOT other directories like

sudo chown -R -c :users /etc

Is this possible with sudo?

Thanks.

If I understand you correctly, I think this outside of the scope of what sudo can do. So I would have to say that no this is not possible using sudo.

To answer your problem, though, I would use Linux ACL (Access Control Lists) to do that sort of thing.

With access control lists, you can set permissions of files and directories on a "per user" or "per group" basis.

To implement it into your system, add "acl" to fstab, so it may look like the following:

UUID=b3d3d8f2  /  ext4  relatime,errors=remount-ro,acl  0  1

Then remount the partition:

sudo mount -o remount /

A simple application to set such permissions is eiciel

sudo apt-get install eiciel

If setup correctly, you do not need to use sudo to carry out what you want to do.

Regards
Iain

[jarrah-95]

i have just actadently blocked all access to sudo exept for apt-get this whould have been alright for what i wanted to use update manager too and i also forgot to make a sudo user that can edit these things
is there any way out of this
thanks