Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a java program that I use to automate the process of creating VPN settings for clients. The program calls couple of bash scripts, create and copies files around. I have to run it under root user because the whole VPN config is under /etc/openvpn. For this directory I need root privileges. On the same machine I have Glassfish application server and it will call the mentioned Java program. Glassfish is run under non-root user.

What is the best, most secure way of running a program as a root user of course without entering a password if I run it via sudo?

share|improve this question

2 Answers 2

safest option would be to find out what group openvpn is owned by and add a non privileged user with access to it - the recommended way is to create an openvpn user, and give it privileges to use openvpn using sudo.

Adding the user you run this program under to the group (probably with just read acces) to give it access to openvpn, and giving it the necessary sudo privileges (to run openvpn - identical settings to what the openvpn user uses) should do the trick safely.

Using root is a lazy way ;)

share|improve this answer
    
I'm already doing that. The problem is not in running OpenVPN itself. The Java program that I have calls scripts to create a clients certificate for example. The whole configuration is in a directory owned by root.root. Even OpenVPN runs as root at first and then changes the priviilges to a non priviliged user. –  kovica Nov 13 '12 at 9:07
    
well, changing the ownership of the directory is my solution. Then give permissions to the user. That way you wouldn't need to run this as root - you'd use a regular user and groups 'properly' rather than running something as root –  Journeyman Geek Nov 13 '12 at 9:11

What I found out is than running a command as sudo without entering password there are two options:

  • echo PASSWORD | sudo -S COMMAND
  • adding following line to /etc/sudoers

    username ALL=(ALL) NOPASSWD: COMMAND

Note that this line has to be after all group definitions. You can check what sudo privileges you have using sudo -l. For this case this yields:

(ALL) ALL
(ALL) NOPASSWD: COMMAND

This means that for all commands password will be required except for the COMMAND. If we would put username ALL=(ALL) NOPASSWD: COMMAND before group definitions then sudo -l would yield:

(ALL) NOPASSWD: COMMAND
(ALL) ALL

This would still require a password for the COMMAND, since (ALL) ALL is specified after NOPASSWD line.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.