Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sorry my dumb question but I don't know how to describe my situation.

There are logs from Jenkins:

ssh '/var/lib/tomcat7/webapps/'
+ id
uid=1004(jenkins) gid=1004(jenkins) groups=1004(jenkins),107(tomcat7)
+ sudo su tomcat7
+ id
uid=1004(jenkins) gid=1004(jenkins) groups=1004(jenkins),107(tomcat7)

Due to security reasons I can't access to myserver with tomcat7 user. "sudo su tomcat7" works without password because I've added this only command to /etc/sudoers with NOPASSWD.

So, the question is: Why I can't su to my tomcat7 user?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I suppose that the script contains this sequence of commands:

sudo su tomcat7

What happens there?

  1. ssh starts the script in a process owned by user jenkins.
  2. sudo is started as a new process and changes the process owner to root.
  3. sudo starts su as root in another process.
  4. su tries to start login shell of the user tomcat7 as user tomcat7.
  5. tomcat7 most probably does not have an interactive shell configured (check grep tomcat7 /etc/passwd).
  6. su exits. (In this session there is no process owned by tomcat7 any more.)
  7. sudo exits. (In this session there is no process owned by root any more.)
  8. Last id is executed under the same user as the whole script - jenkins. The whole script is being executed under the same user. Neither sudo nor su changes that.

What you can do?

  1. Call su with the shell you need. For example: su -s /bin/bash
  2. Run the second id in a process owned by tomcat7. For example: su tomcat7 -c id

Complete example script:

sudo su tomcat7 -s /bin/bash -c id


All the commands to be executed under tomcat7 should be run in a process started by su (by option -c) and pay attention to login shells of users.

share|improve this answer
Thank you very much! I've fixed my script: ssh sudo su tomcat7 -s /bin/bash -c /var/<>/ (/etc/sudoers entry was fixed too) –  dart Nov 10 '13 at 13:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.