Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm currently trying to lock down my users a bit. I've created some users:

  • www.foo
  • www.bar

and a group:

  • apacheadmins

Both www.foo, and www.bar are members of the apacheadmins group. They do not currently have sudo access, but I would like to grant them sudo access for:

  • service httpd configcheck
  • service httpd restart
  • service httpd graceful

I've added the following lines, using visudo at the very bottom of the sudoers file:

### Setting permissions for www.* users
Cmnd_Alias APACHECMDS = /sbin/service httpd configcheck, /sbin/service httpd graceful, /sbin/service httpd restart
%apacheusers ALL = NOPASSWD: APACHECMDS

I would like these users to be able to use these commands without password prompt, but they have key only access, and don't currently have passwords assigned to them.

Whenever I save my changes, open a new bash session as www.foo or www.bar, I am still greeted with a password prompt.

I've played with it a bit, and I can get it to work if I specify the full path, ie:

sudo service httpd graceful does not work. sudo /sbin/service httpd graceful does work.

Can I get this to work without specifying the full path?

EDIT: I'm using:

[foo@bar~]$ uname -a
Linux bar 2.6.18-164.el5 #1 SMP Thu Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
[foo@bar~]$ cat /etc/redhat-release
CentOS release 5.4 (Final)
share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

The problem is that the users' $PATH variable doesn't include /sbin, and so sudo isn't actually finding the command.

$ sudo service acpid status
[sudo] password for mgorven: 
$ sudo /sbin/service acpid status
acpid (pid 3185) is running...
$ echo $PATH
/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin
$ export PATH=$PATH:/sbin:/usr/sbin
$ sudo service acpid status
acpid (pid 3185) is running...

Add /sbin to the users' $PATH to solve this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.