3

I have a sudoers file with many entries.

At the top is a Defaults setting:

# default sudo password is the ROOT password (not the invoking user's password)
Defaults rootpw

However there is one particular command I want to let users run as root so long as they enter their own password.

How can I specify a particular command requires the invoking user's password - thereby overriding the "Defaults" set?

e.g. how to modify the below command to require the invoking user's password (not the root password):

markus ALL = PASSWD: /usr/sbin/tcpdump -p -i eth2 host 192.168.14.15

1 Answer 1

4

Use

Defaults!/usr/sbin/tcpdump !rootpw

to disable rootpw for a single command. See this answer and/or man 5 sudoers for more information.

Alternatively, NOPASSWD option disables password prompt altogether, e.g

markus ALL = NOPASSWD: /usr/sbin/tcpdump -p -i eth2 host 192.168.14.15

finally, you can disable rootpw from a single user with

Defaults:markus !rootpw

If you want to override rootpw for a specific user and specific command, at least following workaround can be used: create wrapper script, e.g /usr/local/bin/special_tcpdump.sh

 #!/bin/sh
 /usr/sbin/tcpdump $*

Then, configure sudoers:

 Defaults!/usr/local/bin/special_tcpdump.sh !rootpw
 markus ALL = PASSWD: /usr/local/bin/special_tcpdump.sh -p -i eth2 host 192.168.14.15
3
  • Thank you for your speedy answer. In particular I want to allow /bin/bash for particular users on particular users... so I wonder if I can have a Defaults for combination, e.g. Defaults:PARTICULAR_USERS@PARTICULAR_HOSTS!/bin/bash !rootpw
    – PP.
    Feb 13, 2014 at 16:25
  • OR if I cannot combine Defaults types on a single line (tried it and didn't parse) can I put a Defaults !rootpw on the line above my specific command and a Defaults rootpw below the specific command?
    – PP.
    Feb 13, 2014 at 16:34
  • 1
    You certainly can't put multiple Defaults lines all over the file - those are applied globally, not only after the fact. For command&user pairs, I updated the answer.
    – Olli
    Feb 13, 2014 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .