Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #160556 > unrolled thread

sudo does not respond to settings in /etc/sudoers

Back to article view | Back to linux.debian.user

Contents

  sudo does not respond to settings in /etc/sudoers Ken Heard <kenslists@teksavvy.com> - 2015-11-14 09:30 +0100
    Re: sudo does not respond to settings in /etc/sudoers Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-11-14 15:40 +0100
      Re: sudo does not respond to settings in /etc/sudoers Ric Moore <wayward4now@gmail.com> - 2015-11-14 19:30 +0100
        Re: sudo does not respond to settings in /etc/sudoers Joe <joe@jretrading.com> - 2015-11-14 21:10 +0100
          Re: sudo does not respond to settings in /etc/sudoers Ric Moore <wayward4now@gmail.com> - 2015-11-15 16:50 +0100
            Re: sudo does not respond to settings in /etc/sudoers Joe <joe@jretrading.com> - 2015-11-15 17:20 +0100
              Re: sudo does not respond to settings in /etc/sudoers Ric Moore <wayward4now@gmail.com> - 2015-11-15 17:30 +0100
            Re: sudo does not respond to settings in /etc/sudoers Teemu Likonen <tlikonen@iki.fi> - 2015-11-15 17:30 +0100
              Re: sudo does not respond to settings in /etc/sudoers Ken Heard <kenslists@teksavvy.com> - 2015-11-16 08:00 +0100
                Re: sudo does not respond to settings in /etc/sudoers Andreas Henriksson <andreas@fatal.se> - 2015-11-16 13:10 +0100
                  Re: sudo does not respond to settings in /etc/sudoers Ken Heard <kenslists@teksavvy.com> - 2015-11-16 15:40 +0100
                Re: sudo does not respond to settings in /etc/sudoers Teemu Likonen <tlikonen@iki.fi> - 2015-11-16 15:20 +0100
    Re: sudo does not respond to settings in /etc/sudoers Teemu Likonen <tlikonen@iki.fi> - 2015-11-14 21:30 +0100

#160556 — sudo does not respond to settings in /etc/sudoers

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In my Wheezy box I want to be able to run any root command as my user
without having to enter a password to do so.  I assume that there are
two ways to do so: either make my user a member of the sudo group, or
add a line to sudoers giving such privileges to my user.  Neither worked.

My sudoers file reads as follows:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults	env_reset
Defaults	mail_badpass
Defaults
secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL:ALL) ALL
# ken	ALL=NOPASSWD: ALL
# martin	All=(ALL:ALL) ALL
# Allow members of group sudo to execute any command
%sudo	ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

I first entered the line under "user privilege specification"
beginning with "ken" -- without the "#" of course -- it did not work.
 Next I commented out that line and added to the sudo group "ken" my
user.  That did not work either.

The command "visudo -c" returns the following:

/etc/sudoers: parsed OK
/etc/sudoers.d/README: parsed OK
/etc/sudoers.d/tde-secure-path: parsed OK

Strangely enough I have the same sudoers file in another computer
using Jessie.  On that computer both the options I tried for the
wheezy computer worked.

Is this a bug for the Wheezy computer, or is there something I did not
do or did wrong to prevent me from achieving the result I desired?

Regards, Ken


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZG7JkACgkQlNlJzOkJmTd6LACeMoTBd6V5VLmOMfsyg3p1DuXI
rxEAnRfp5FdfLZwxiNB4fZHYi9MMxJx1
=PwCP
-----END PGP SIGNATURE-----

[toc] | [next] | [standalone]

#160563

El 14/11/15 a las 02:11, Ken Heard escribió:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> In my Wheezy box I want to be able to run any root command as my user
> without having to enter a password to do so.  I assume that there are
> two ways to do so: either make my user a member of the sudo group, or
> add a line to sudoers giving such privileges to my user.  Neither worked.

You have to add the "NOPASSWD" option. Check the "sudoers" man page.

[toc] | [prev] | [next] | [standalone]

#160567

On 11/14/2015 09:36 AM, Mario Castelán Castro wrote:
> El 14/11/15 a las 02:11, Ken Heard escribió:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> In my Wheezy box I want to be able to run any root command as my user
>> without having to enter a password to do so.  I assume that there are
>> two ways to do so: either make my user a member of the sudo group, or
>> add a line to sudoers giving such privileges to my user.  Neither worked.
>
> You have to add the "NOPASSWD" option. Check the "sudoers" man page.

Add your user to the sudo group like this in /etc/group :
sudo:x:27:ric
...using your own user name. Then it will work, if you added your user 
to /ect/sudoers like:
# User privilege specification
root	ALL=(ALL:ALL) ALL
ric	ALL=(ALL:ALL) ALL


...works for me(tm)  :)Ric



-- 
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
http://linuxcounter.net/user/44256.html

[toc] | [prev] | [next] | [standalone]

#160568

On Sat, 14 Nov 2015 13:20:19 -0500
Ric Moore <wayward4now@gmail.com> wrote:

> On 11/14/2015 09:36 AM, Mario Castelán Castro wrote:
> > El 14/11/15 a las 02:11, Ken Heard escribió:  
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> In my Wheezy box I want to be able to run any root command as my
> >> user without having to enter a password to do so.  I assume that
> >> there are two ways to do so: either make my user a member of the
> >> sudo group, or add a line to sudoers giving such privileges to my
> >> user.  Neither worked.  
> >
> > You have to add the "NOPASSWD" option. Check the "sudoers" man
> > page.  
> 
> Add your user to the sudo group like this in /etc/group :
> sudo:x:27:ric
> ...using your own user name. Then it will work, if you added your
> user to /ect/sudoers like:
> # User privilege specification
> root	ALL=(ALL:ALL) ALL
> ric	ALL=(ALL:ALL) ALL
> 
> 
> ...works for me(tm)  :)Ric
> 
> 
> 

The OP did explicitly say he wanted to use the NOPASSWD option, and his
sudoers file shows it in use, currently commented. Your example will
still ask for a password, and anyway it's either/or: you can either add
yourself to the sudo group or add your name to sudoers, you don't need
both. The sudo group is just a quick and simple way of giving the same
set of [presumably low-level] privileges to a number of people, and
the sudo sudoers entry really shouldn't be NOPASSWD, as by default it
gives full root privileges.

I don't use NOPASSWD myself, so I can't give a definitive answer (as
in 'this works for me') to the question, but presumably there's a
semantic issue somewhere. Visudo can only pick up syntax errors, it
can't tell what you meant to achieve. 

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#160582

On 11/14/2015 03:01 PM, Joe wrote:
Your example will
> still ask for a password, and anyway it's either/or: you can either add
> yourself to the sudo group or add your name to sudoers, you don't need
> both.

I had to, before it would work. YMMV, Ric


-- 
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
http://linuxcounter.net/user/44256.html

[toc] | [prev] | [next] | [standalone]

#160583

On Sun, 15 Nov 2015 10:44:10 -0500
Ric Moore <wayward4now@gmail.com> wrote:

> On 11/14/2015 03:01 PM, Joe wrote:
> Your example will
> > still ask for a password, and anyway it's either/or: you can either
> > add yourself to the sudo group or add your name to sudoers, you
> > don't need both.  
> 
> I had to, before it would work. YMMV, Ric
> 
> 

You must have an unusually paranoid computer. I have a sid workstation
and wheezy server running at the moment, neither of which has any
members of the sudo group, which I think is a relatively recent
innovation in Debian.

It might be one of those situations where 'I did A and it didn't work,
I did B and it didn't work, I did C and it finally did work, and I was
so relieved that I could get on with the job that was being held up that
I didn't take the time to go back and undo A and B'. We've all been
there, and have bits of mostly harmless cruft here and there to prove
it...

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#160584

On 11/15/2015 11:18 AM, Joe wrote:
> On Sun, 15 Nov 2015 10:44:10 -0500
> Ric Moore <wayward4now@gmail.com> wrote:
>
>> On 11/14/2015 03:01 PM, Joe wrote:
>> Your example will
>>> still ask for a password, and anyway it's either/or: you can either
>>> add yourself to the sudo group or add your name to sudoers, you
>>> don't need both.
>>
>> I had to, before it would work. YMMV, Ric
>>
>>
>
> You must have an unusually paranoid computer. I have a sid workstation
> and wheezy server running at the moment, neither of which has any
> members of the sudo group, which I think is a relatively recent
> innovation in Debian.
>
> It might be one of those situations where 'I did A and it didn't work,
> I did B and it didn't work, I did C and it finally did work, and I was
> so relieved that I could get on with the job that was being held up that
> I didn't take the time to go back and undo A and B'. We've all been
> there, and have bits of mostly harmless cruft here and there to prove
> it...

I just installed fresh, after a stinkin' seagate drive failed miserably, 
and had to do both steps before sudo would work. It's become automatic 
to do A and B to get C. But then again, I've never reversed the process 
to see if A or B could be omitted. Maybe I'm scared. <cackles>  Ric




-- 
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
http://linuxcounter.net/user/44256.html

[toc] | [prev] | [next] | [standalone]

#160585

[Multipart message — attachments visible in raw view] — view raw

Ric Moore [2015-11-15 10:44:10-05] wrote:

> On 11/14/2015 03:01 PM, Joe wrote:
>> it's either/or: you can either add yourself to the sudo group or add
>> your name to sudoers, you don't need both.
>
> I had to, before it would work. YMMV, Ric

Maybe you added the user to the "undo" group but forgot to test it with
a new login session. Group changes don't affect the current login
session (unless newgrp is used).

[toc] | [prev] | [next] | [standalone]

#160620

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 2015-11-15 23:26, Teemu Likonen wrote:

> Maybe you added the user to the "undo" group

Surely you mean the "sudo" group?

> but forgot to test it with a new login session. Group changes
> don't affect the current login session (unless newgrp is used).

My eureka moment! I forgot to logout and in again as my user before
testing the various options. I tested the two options to do what I
wanted to do as described in my original post, but not both on, or
open at the same time. I found that adding to the "user privilege
specification" section in the sudoers file the following line DOES work:

ken ALL=NOPASSWD: ALL

However, removing that line, and in the TDE User Manager (Kuser)
simply adding my user to the "sudo" group does NOT work. That option
DOES nevertheless work in my Jessie box. Strange.

Thanks guys for collectively putting me on the right track.

Ken




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZJfKEACgkQlNlJzOkJmTfY6ACeOijk3QTayP+2rIpUJ0N9Zj2x
sSYAn01UPKZyBd6QAa1t0GbcT+9d7hF3
=hCiX
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#160628

Hello!

On Mon, Nov 16, 2015 at 01:50:09PM +0700, Ken Heard wrote:
[...]
> My eureka moment! I forgot to logout and in again as my user before
> testing the various options.
[...]

For what it's worth, if you want to avoid logging out/in you can
temporarily join the group in your shell by using "newgrp sudo".

Regards,
Andreas Henriksson

[toc] | [prev] | [next] | [standalone]

#160631

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 2015-11-16 19:02, Andreas Henriksson wrote:

> For what it's worth, if you want to avoid logging out/in you can 
> temporarily join the group in your shell by using "newgrp sudo".

Thank you for that tip; it is useful to know.

Ken


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZJ6QYACgkQlNlJzOkJmTd7XQCfVkYMZawUyHDxy7A/O96OYmaF
SfIAmwTd50WNppet3r1P9DknHJtILdGv
=JG+B
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#160630

[Multipart message — attachments visible in raw view] — view raw

Ken Heard [2015-11-16 13:50:09+07] wrote:

> On 2015-11-15 23:26, Teemu Likonen wrote:
>> Maybe you added the user to the "undo" group
>
> Surely you mean the "sudo" group?

Yes, of course. :-)

[toc] | [prev] | [next] | [standalone]

#160569

[Multipart message — attachments visible in raw view] — view raw

Ken Heard [2015-11-14 15:11:05+07] wrote:

> In my Wheezy box I want to be able to run any root command as my user
> without having to enter a password to do so.

> # ken	ALL=NOPASSWD: ALL

How about this:

    ken ALL = (root) NOPASSWD: ALL

Works here but this is Debian 8 (Jessie), not Wheezy.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web