3

I'm running a home automation package called HomeSeer on a Ubuntu 15.04 server. I have it configured to run with a service account (called "_homeseer"), and I've chown'd the app directory to _homeseer:_homeseer.

To install updates to this package, I download a tar.gz file and then run the vendor-supplied "update.sh" script. This script extracts the compressed file, which happens to also overwrite itself (update.sh)... so I'm thinking I can't just change that script, unless I copy it out to a separate folder somewhere.

As part of update.sh, there's a line that calls "sudo update_extra.sh". Since I'm running update.sh as the service account, this sudo line prompts for the service account's password... which I don't remember (nor do I think I want to).

I don't want to grant that account full sudo rights without a password, as it would be a significant security risk (i.e., the app runs a web server). I'm also a bit wary of giving it full sudo rights to run that update_extra.sh file as root, since that file can be updated by the same service account.

My question:

Is it possible to configure sudo (i.e., visudo) so if the _homeseer account tries to use sudo, it instead prompts for my personal account's password, and runs with the sudo rights that I have? I'd rather not set a root password if I can avoid it... but a preliminary look seems to indicate I might not have much of a choice, if I want to go this route.

Or do I need to modify that update.sh script, configure group permissions so I can apply the updates as myself, and chown to the service account afterwards?

1 Answer 1

2

You can have sudo deal with this.

If you add this to your sudoers file:

_homeseer hostname = (_homeseer) NOPASSWD: /path/to/update.sh
  • hostname = output of hostname on your machine.

One thing to take note of is there isn't a 100% secure way to deal with update.sh since it could contain any command, and I am assuming that it will change over time, meaning you can't use a HASH function to ensure that the script is the same as it was before.

1
  • Thanks! Within update.sh, the vendor has a line that reads "sudo ./update_extra.sh", which is the line that is giving me a bit of grief. Granted, update_extra.sh doesn't contain anything significant yet... so I might be able to make do with your suggestion. However, I expect that the vendor will eventually fill this file with code that should be ran "as root". I don't want _homeseer to be able to sudo to root without a password, obviously. So I'm guessing I should just write my own update script to run as me and chown/chmod the folder when it's done...?
    – boonebytes
    Jun 8, 2015 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .