2

I have 2 linux servers. RHEL 5.11 and RHEL 7.3. And I have a bash script named "deploy.sh" at /app/deploy/deploy.sh and /app2/deploy/deploy.sh. There is a user group named "deployers" on Centrify and a user who member of this "deployers" group. This user (I'll call it as "deployer") can run deploy.sh script with dzdo on first server (5.11 Tikanga) but it cannot run the same script on second server (7.3 Maipo).

The following output is from Tikanga:

[deployer@tikanga ~]$ dzdo -u depuser /app/deploy/deploy.sh
Success!

[deployer@tikanga ~]$ ls -la /app/deploy/ | grep deploy
-rwxr-xr-x  1 depuser depuser     4960 Apr 14  2016 deploy.sh

[root@tikanga ~]# cat /etc/sudoers | grep deployers
%deployers ALL=(depuser)   NOPASSWD: /app/deploy/deploy.sh

And following output is from Maipo:

[deployer@maipo ~]$ dzdo -u depuser /app2/deploy/deploy.sh
Sorry, user deployer is not allowed to execute '/app2/deploy/deploy.sh' as depuser on maipo.

[deployer@maipo ~]$ ls -la /app2/deploy/ | grep deploy
-rwxr-xr-x.  1 depuser depuser  5159 Aug 17 12:22 deploy.sh

[root@maipo ~]# cat /etc/sudoers | grep deployers
%deployers    ALL=(depuser)   NOPASSWD: /app2/deploy/deploy.sh

Both of the servers in the domain with Centrify.

  • I'd suggest a chgrp deployers /app2/deploy/deploy.sh, however, your would lose the added security of requiring a su-like call before running the script. – Nathan.Eilisha Shiraini Aug 23 '17 at 9:03
  • It does not work. Same error again. – Gefolge Aug 23 '17 at 9:08
  • 2
    That dot at the end of the permissions on app2 might suggest SELinux has something to do with this – mcalex Aug 23 '17 at 9:29
  • I will try disable selinux when i get permit for rebooting the server. Thanks. – Gefolge Aug 23 '17 at 10:27
  • It was not about selinux. It was about Centrıfy user/group rules. – Gefolge Aug 25 '17 at 11:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.