I created bash script on Linux Redhat with vim
My script is working well on an user.
I need to esxute on the same script this command
su - root with password
VGDISPLAY -v |grep "LV Status"
the probem is when I execute my script the part of the normal user is done
and the other part with root not done
my question how can I do to execute this
I need to switch in the same script to root
Best regards
I'd recommend not switching to the root user in the script for specific tasks/commands but assigning SUDO privileges to your user (by which you are running the script), and using sudo command in the script for the tasks/commands that need elevations.
Hint: By sudo command you may run a process on behalf of another user (root probably).
If you are not familiar with sudo command or how to assign SUDO privileges to a user, please see the following link or google it.
https://phoenixnap.com/kb/linux-sudo-command
PS. Providing SUDO privileges to a user is configurable whether to be used for all commands or limited commands. For testing purposes, you may configure the user to be able to run all commands with sudo to gain the privileges, but for production use it is strongly recommended to limit the user to be able to use only necessary commands with sudo and nothing more.
Related
Is it possible avoid sudo word while executing the higher privileged commands to a non-root user via a sudo policy such non-root users should not be able to know that he is executing higher privileged commands and also the usage of sudo might be complex.
Example:
Normal Execution of Sudo Command.
$ sudo -u root /usr/bin/tcpdump
non-root users should execute tcpdump like below.
$ tcpdump
Thanks in advance.
Note: I have defined a Sudo Policy for non-root users. So, when a non-root user executes tcpdump, in the backend it should execute as
sudo -u root tcpdump.
Yes. It is possible.
You should:
1- Create a new specific new group where some users would belong:
groupadd nonroot
2- Add your privileged users to that group:
2.1- Edit /etc/group:
vim /etc/group
2.2- Find the line of new created group. It should look like that:
nonroot:x:127:
2.3- At the end, add your privilaged users:
nonroot:x:127:user1,user2
3- Change the group of your binary:
chgrp nonroot /usr/bin/tcpdump
4- Give group execution permissions to the binary:
chmod g+x /usr/bin/tcpdump
You have to have in count that if the binary reads, writes or executes files which user1 has no permissions, you'll have modify them in the same way.
If you cannot change the group of the binary, check the right answer of post bellow, which is a similar way:
Allow users of a certain group to run a command without sudo
Hope it helps.
NOTE: Commands may differ between different linux/unix distros.
I can see at least two possibilities:
Wrap it in a script (an alias is also possible, but if users can use different shells or just start them manually, it can turn into a maintenence hell)
Set the suid bit on tcpdump, but that means everyone who can invoke tcpdump always does so as the owner.
You might want to explore using sudoers file.
Using CentOS as an example (should be similar for Debian), create a file within sudoers.d with the relevant name, e.g. tcpdump and include the following:
user ALL=NOPASSWD: /usr/bin/tcpdump command
Replace the user and command to suit your purpose. You can find out more here.
This coupled with a alias tcpdump='sudo tcpdump for the user should fit your use case.
I have a script that runs iftop in text mode, cuts down the output to what I'm concerned in, and saves it to a text file along with the output of the date command (I am monitoring network usage on various interfaces over time). Only problem I'm having is I'm trying to run my script every 15 minutes via the crontab, and in order to run the iftop command I need sudo permissions. Does anyone know some way to change the permissions of iftop to make it so I don't need sudo permissions?
Alternatively if I can give the script the ability to run the command with sudo that would be fine by me as well. I tried adding the script to the sudoers file via sudo visudo and adding the line:
user ALL=(ALL) NOPASSWD: /home/user/network_usage.sh
but that didn't work...perhaps a result of executing from the crontab?
Thanks,
-Eric
A more granular approach would be to use:
# setcap cap_net_raw=eip $(which iftop)
This lets iftop capture packets but does not give the process full root privileges. In case of a security problem or bug with "iftop" its side effects would be much more limited.
Related: https://unix.stackexchange.com/questions/189750/how-can-i-run-script-without-root-to-sniff-network-libpcap
If you have root access on the machine the quick and dirty way:
chmod +s $(which iftop)
This will make it run w/ root privileges no matter who invokes it.
But I still think your sudo like should work.
You may use root's crontab to run the script.
If instead of crontab -e you use sudo crontab -e you will edit root's crontab. Tasks specified in that file will run under root's account and privileges.
Alternatively, you can set the setuid access flag for your script file. To do so first change the owner of the file to root, then enable setuid like this:
sudo chown root /home/user/network_usage.sh
sudo chmod +s-w /home/user/network_usage.sh
The setuid bit makes an executable file run with the effective UID of its owner.
Regardless of what approach you take, be very careful.
Make your script owned by root and don't let any other user write to it, otherwise it could ease a privilege escalation.
Be aware of the side effects of your setuid programs. If the script has setuid and may create or modify files, it might be used by someone else to modify or create files they aren't supposed to. Always check the manual before giving setuid to any program you haven't written.
Is there any suitable shell script for shutting down or restarting a Linux machine? I have tried a shell script for shutdown, but when I enter sudo shutdown it will ask for the password. How we can enter the password using the script?
Another, in my opinion cleaner approach:
Create a new file in /etc/sudoers.d/ with content:
%users ALL=NOPASSWD: /sbin/shutdown
%users ALL=NOPASSWD: /sbin/reboot
This causes sudo to not ask for the password, if any user of group "users" tries to execute a shutdown or reboot. Of course you can also specify another group, maybe a newly created group for finer control of reboot permissions.
More information about the other possible settings for sudo can be found in the Manpage.
Yes, use the -S switch which reads the password from STDIN:
$echo <password> | sudo -S <command>
So to shut down the machine, your command would be like this (just replace <password> with your password):
$echo <password> | sudo -S poweroff
Exposing your password is generally bad idea search for something that can protect / hide it. In the past I've used Jenkins plugins to do this while executing the scripts regularly.
if you really want to achieve it, you should write a script containing the shutdown command; make root be its owner, then set the SUID bit with the chmod command and give to it executable permission for everybody. When executed, the owner of the script would become root and no password should be asked.
This question is a bit specific and I want to do the equivalent of the following code:
# these commands must be run as root
root#server:$ useradd -m -s /bin/bash elspeth # add user named elspeth
# -m creates a home folder, -s sets elspeth to use bash by default
root#server:$ usermod -a -G sudo elspeth # add elspeth to the sudoers group
root#server:$ passwd elspeth # set password for elspeth
root#server:$ su - elspeth # switch-user to being elspeth!
elspeth#server:$
elspeth#server:$ sudo apt-get install nginx
elspeth#server:$ sudo service nginx start
I click "Run as administrator" when opening the Command Prompt, which I assume is "running as root."
I did a little research and found commands like net user (username) (pwd) which I assume are Windows equivalents. Now first, the sudo group part I am confused. I enter:
net localgroup sudo (user) /add
but get a "The specified local group does not exist." Am I to just make a new "sudo" group?
There is also the part of the code setting a user to "use bash by default" of which I do not know/understand the Windows equivalent.
Lastly for the first chunk of code, there is a su command. Would runas be the equivalent? I read that you can switch users from the command prompt on Windows through runas but then I have to specify a program to run (would it be bash in this case?)
And from what I read on StackOverflow, runas is actually the Windows equivalent to Linux's sudo, which gets more confusing for me in the second chunk of code where we have to use sudo (and for what it's worth, sudo is an unrecognized command for me).
For reference and context, this is the book I am using and the exact excerpt dealing with this code:
http://chimera.labs.oreilly.com/books/1234000000754/ch08.html#_user_accounts_ssh_and_privileges
You can't just translate commands like that into Windows; Linux and Windows are completely different especially when it comes to user management.
sudo is just switch user do; it allows you to run a command as another user. In most cases, this is done to allow normal users to execute commands as root.
On Windows, this is "Run As Administrator"; or if you are already part of the Administrator's group - then you can skip this entirely.
The first line adds a user, assigns them a home directory and a shell.
In Windows, you simply add a user; as there really isn't a concept of "shell" in Windows - that is, all users by default use the Windows Desktop Environment - which is their "shell". A shell is just a program that accepts input for execution. Most texts will tell you that cmd.exe (or PowerShell) is the "shell", but this is not strictly true. These are just another interface to execute commands - the main "shell" is Windows itself.
Further, all users get a home directory by default (unless they are a system account).
For more on how to actually create the users and add them to groups, see PowerShell: Create Local User Account
Your last two lines are installing nginx; the closest thing for that command on Windows is chocolatey, but it needs to already be installed.
Otherwise, specifically for nginx you simply download the zip and run the command.
I want to add a line in the crontab (on my local machine) which will run every five minutes. My problem is the command I am going to use requires sudo :
sudo indexer --config /usr/local/etc/sphinx.conf --all --rotate
Is there a way I can run the command without using sudo and without prompting for password ?
Thanks!
Put it in the crontab of root
sudo crontab -e
There you can put
indexer --config /usr/local/etc/sphinx.conf --all --rotate
All commands in this crontab will be executed as root. If you just du crontab -e as your current user, they will be executed under your users permissions.
Just append your command to the sudoer file list by using cmd visudo(this cmd requires root priviledge) as below:
<YOUR_USER_NAME> ALL = NOPASSWD:<ABSOLUTE-PATH-TO-CMD>
Take care of the ABSOLUTE-PATH-TO-CMD,It may become a security hole.
Its extremely dangerous to put applications in root's crontab unless the box is secured well from hackers. If by chance someone replaces the binaries (including libraries), you're gone!
A better way would be to chown all the files the binary accesses to an unprivileged user and run the job as the unprivileged user.
Any of the binary files the application uses should not be writeable by anyone except root.
run it as a root ? or sphinx user ? try to find out which user you need it to be run as and add it to that users cron
You can configure sudo not to ask password. Read man sudoers for how to do that. Search for NOPASSWD string.