Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a sudoers file with many entries.

At the top is a Defaults setting:

# default sudo password is the ROOT password (not the invoking user's password)
Defaults rootpw

However there is one particular command I want to let users run as root so long as they enter their own password.

How can I specify a particular command requires the invoking user's password - thereby overriding the "Defaults" set?

e.g. how to modify the below command to require the invoking user's password (not the root password):

markus ALL = PASSWD: /usr/sbin/tcpdump -p -i eth2 host 192.168.14.15
share|improve this question

1 Answer 1

up vote 1 down vote accepted

Use

Defaults!/usr/sbin/tcpdump !rootpw

to disable rootpw for a single command. See this answer and/or man 5 sudoers for more information.

Alternatively, NOPASSWD option disables password prompt altogether, e.g

markus ALL = NOPASSWD: /usr/sbin/tcpdump -p -i eth2 host 192.168.14.15

finally, you can disable rootpw from a single user with

Defaults:markus !rootpw

If you want to override rootpw for a specific user and specific command, at least following workaround can be used: create wrapper script, e.g /usr/local/bin/special_tcpdump.sh

 #!/bin/sh
 /usr/sbin/tcpdump $*

Then, configure sudoers:

 Defaults!/usr/local/bin/special_tcpdump.sh !rootpw
 markus ALL = PASSWD: /usr/local/bin/special_tcpdump.sh -p -i eth2 host 192.168.14.15
share|improve this answer
    
Thank you for your speedy answer. In particular I want to allow /bin/bash for particular users on particular users... so I wonder if I can have a Defaults for combination, e.g. Defaults:PARTICULAR_USERS@PARTICULAR_HOSTS!/bin/bash !rootpw –  PP. Feb 13 at 16:25
    
OR if I cannot combine Defaults types on a single line (tried it and didn't parse) can I put a Defaults !rootpw on the line above my specific command and a Defaults rootpw below the specific command? –  PP. Feb 13 at 16:34
1  
You certainly can't put multiple Defaults lines all over the file - those are applied globally, not only after the fact. For command&user pairs, I updated the answer. –  Olli Feb 13 at 16:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.