0

I'm currently trying to lock down my users a bit. I've created some users:

  • www.foo
  • www.bar

and a group:

  • apacheadmins

Both www.foo, and www.bar are members of the apacheadmins group. They do not currently have sudo access, but I would like to grant them sudo access for:

  • service httpd configcheck
  • service httpd restart
  • service httpd graceful

I've added the following lines, using visudo at the very bottom of the sudoers file:

### Setting permissions for www.* users
Cmnd_Alias APACHECMDS = /sbin/service httpd configcheck, /sbin/service httpd graceful, /sbin/service httpd restart
%apacheusers ALL = NOPASSWD: APACHECMDS

I would like these users to be able to use these commands without password prompt, but they have key only access, and don't currently have passwords assigned to them.

Whenever I save my changes, open a new bash session as www.foo or www.bar, I am still greeted with a password prompt.

I've played with it a bit, and I can get it to work if I specify the full path, ie:

sudo service httpd graceful does not work. sudo /sbin/service httpd graceful does work.

Can I get this to work without specifying the full path?

EDIT: I'm using:

[foo@bar~]$ uname -a
Linux bar 2.6.18-164.el5 #1 SMP Thu Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
[foo@bar~]$ cat /etc/redhat-release
CentOS release 5.4 (Final)

1 Answer 1

0

The problem is that the users' $PATH variable doesn't include /sbin, and so sudo isn't actually finding the command.

$ sudo service acpid status
[sudo] password for mgorven: 
$ sudo /sbin/service acpid status
acpid (pid 3185) is running...
$ echo $PATH
/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin
$ export PATH=$PATH:/sbin:/usr/sbin
$ sudo service acpid status
acpid (pid 3185) is running...

Add /sbin to the users' $PATH to solve this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .