3

I'm running a home automation package called HomeSeer on a Ubuntu 15.04 server. I have it configured to run with a service account (called "_homeseer"), and I've chown'd the app directory to _homeseer:_homeseer.

To install updates to this package, I download a tar.gz file and then run the vendor-supplied "update.sh" script. This script extracts the compressed file, which happens to also overwrite itself (update.sh)... so I'm thinking I can't just change that script, unless I copy it out to a separate folder somewhere.

As part of update.sh, there's a line that calls "sudo update_extra.sh". Since I'm running update.sh as the service account, this sudo line prompts for the service account's password... which I don't remember (nor do I think I want to).

I don't want to grant that account full sudo rights without a password, as it would be a significant security risk (i.e., the app runs a web server). I'm also a bit wary of giving it full sudo rights to run that update_extra.sh file as root, since that file can be updated by the same service account.

My question:

Is it possible to configure sudo (i.e., visudo) so if the _homeseer account tries to use sudo, it instead prompts for my personal account's password, and runs with the sudo rights that I have? I'd rather not set a root password if I can avoid it... but a preliminary look seems to indicate I might not have much of a choice, if I want to go this route.

Or do I need to modify that update.sh script, configure group permissions so I can apply the updates as myself, and chown to the service account afterwards?

2

You can have sudo deal with this.

If you add this to your sudoers file:

_homeseer hostname = (_homeseer) NOPASSWD: /path/to/update.sh
  • hostname = output of hostname on your machine.

One thing to take note of is there isn't a 100% secure way to deal with update.sh since it could contain any command, and I am assuming that it will change over time, meaning you can't use a HASH function to ensure that the script is the same as it was before.

  • Thanks! Within update.sh, the vendor has a line that reads "sudo ./update_extra.sh", which is the line that is giving me a bit of grief. Granted, update_extra.sh doesn't contain anything significant yet... so I might be able to make do with your suggestion. However, I expect that the vendor will eventually fill this file with code that should be ran "as root". I don't want _homeseer to be able to sudo to root without a password, obviously. So I'm guessing I should just write my own update script to run as me and chown/chmod the folder when it's done...? – boonebytes Jun 8 '15 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.