Ubuntu Linux “su” disable password

Question

I am trying to get rid of the password prompt in Ubuntu Linux, during the "su" command. Basically, I need to do something like:

su otheruser

to enable a few of my applications to run in batch mode. However, since it runs in batch, I would like to disable the password prompt.

What I have tried to do is:

sudo visudo
otheruser ALL=(ALL) NOPASSWD: /bin/su 

but this still asks me for the password.

For example, to disable sudo from asking a password, I did:

sudo visudo
otheruser ALL=NOPASSWD: ALL

and it works fine. However, when I try this with su, it does not work.

Has anyone encountered this problem? Any guidance would be much appreciated.

Answer 1

su is not related in any way to sudo or the sudoers file. It always asks for the target user's password. (Even if it did, you are putting the wrong username in 'sudoers'.)

For batch usage, you can use sudo -u otheruser, along with the NOPASSWD option in sudoers. For example:

$ sudo visudo

JohnJ    ALL=(otheruser) NOPASSWD: /usr/bin/myprogram

$ sudo -u otheruser myprogram

Answer 2

Here are two solutions, first you need to know what the "set user bit" http://en.wikipedia.org/wiki/Setuid is/does. To do that read e.g. http://meinit.nl/set-user-id-bit-demostration

Take care though, because a lot of security hole exists if you dont setup things right, as this is a powerful tool and "with great power comes great responsibility" ;) Note that this tutorial is for traditional systems, if you have ACL (Access Control Lists), you need to give the respective to suid permission.

Solution 1: Security-wise the better one: If you want to su to one or two particular user(s), have one or two files that suid to those users. If you have more users, depending on what you are doing, create a user group, and use the group.

Solution 2: The simplest one sometimes: have the file suid to root. THIS IS ESPECIALLY DANGEROUS, avoid it.