I'm currently trying to lock down my users a bit. I've created some users:
www.foo
www.bar
and a group:
apacheadmins
Both www.foo
, and www.bar
are members of the apacheadmins
group. They do not currently have sudo access, but I would like to grant them sudo access for:
service httpd configcheck
service httpd restart
service httpd graceful
I've added the following lines, using visudo at the very bottom of the sudoers file:
### Setting permissions for www.* users
Cmnd_Alias APACHECMDS = /sbin/service httpd configcheck, /sbin/service httpd graceful, /sbin/service httpd restart
%apacheusers ALL = NOPASSWD: APACHECMDS
I would like these users to be able to use these commands without password prompt, but they have key only access, and don't currently have passwords assigned to them.
Whenever I save my changes, open a new bash session as www.foo
or www.bar
, I am still greeted with a password prompt.
I've played with it a bit, and I can get it to work if I specify the full path, ie:
sudo service httpd graceful
does not work.
sudo /sbin/service httpd graceful
does work.
Can I get this to work without specifying the full path?
EDIT: I'm using:
[foo@bar~]$ uname -a
Linux bar 2.6.18-164.el5 #1 SMP Thu Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
[foo@bar~]$ cat /etc/redhat-release
CentOS release 5.4 (Final)