1

Setting up a rails server (Ubuntu 12.10) on DigitalOcean and I want a non-root user to run some deployment commands with root access by prefixing sudo to the command and entering a password. I thought I could edit visudo like below, but permissions is denied. Am I missing something?

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# User privilege specification
root    ALL=(ALL:ALL) ALL
nonrootuser ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

I made nonrootuser a member of the deployers group in case I have multiple deployment agents in the future. That group isn't called out in visudo, but I don't know if it's relevant, so I'm mentioning it here.

Commands like this fail from my dev box (not the server.) I would expect this to append the contents of my dev box public key to the server's authorized_keys file on the server after prompting for nonrootuser password. Actual result is permissions denied.

cat ~/.ssh/id_rsa.pub | ssh -p 12345 [email protected] 'cat >> ~/.ssh/authorized_keys'

I've attempted rebooting the box entirely, and still no change. I've also tried sudo cat... in my piped command with no results.

2
  • Your command example does not have sudo anywhere in it… Mar 12, 2014 at 23:53
  • Updated question to note that I've tried sudo cat... as well. I was somehow able to solve this by deleting the user and recreating. Somehow, that worked.
    – David Fox
    Mar 13, 2014 at 0:00

2 Answers 2

1
  1. /etc/sudoers does not grant any privileges directly to the user's account. It only authorizes the user to run various commands through the sudo tool (which runs them under the root account). Therefore sudo cat /etc/shadow would work, but cat /etc/shadow would still not.

  2. Pipes and redirections are processed by the shell before each command is run; that is, if you run sudo cat > somefile, your shell (which runs under your own account) first tries to open somefile for writing; and – if it succeeds – only then runs sudo cat with the file attached to its stdout. In other words, sudo does not apply to redirections unless you somehow pass them as part of the command, e.g. sudo sh -c "cat > somefile".

1
  • This is a great explanation.
    – David Fox
    Mar 13, 2014 at 18:19
1

In order for your users to have sudo access, according to your sudo configuration that you have posted, they would need to be members of either the admin or the sudo group. If you want to grant that to the group deployers, then copy the sudo group config to a new line and change it to deployers.

%deployers   ALL=(ALL:ALL) ALL
1
  • This did not directly resolve, but when I userdel'ed the user and recreated it, somehow it corrected itself. Also, adding again to deployers group and using this syntax (without the explicit user) worked. +1
    – David Fox
    Mar 13, 2014 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .