Allow multiple users to run several root commands

hedkandi · November 30, 2011, 6:17am

I am using SUSE Linux Enterprise Server 10 SP2 (i586) and I had earlier ammended my sudoers file to allow users to become root user with "sudo su - " command

Now I am trying to add multiple users to the sudoers file to run several commands such as restarting the server, restarting the nagios services and for test purposes to edit the sudoers file (won't be implemented, it's just for test purposes)

When I had defined the host, user, and command alias in the sudoers life as such, I wasn't able to save the file. I kept getting this message:

>>> sudoers file: syntax error, line 13 <<<
sudo: parse error in /etc/sudoers near line 13

followed by options if I'd like to continue to edit, quit or save and exit (dangerous)

And this is how my sudo file look like:

my-mnag0:/etc # more sudoers
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

Host_Alias    LAN = my-mnag.os.itelligence.com.my

# User alias specification

User_Alias    GHELPDESK = test

# Cmnd alias specification

Cmnd_Alias    SUDO = visudo

# Defaults specification

Defaults    logfile=/var/log/sudo.log, log_year

# prevent environment variables from influencing programs in an
# unexpected or harmful way (CVE-2005-2959, CVE-2005-4158,
# CVE-2006-0151)
Defaults always_set_home
Defaults env_reset

# In the default (unconfigured) configuration, sudo asks for the root password.
# This allows use of an ordinary user account for administration of a freshly
# installed system. When configuring sudo, delete the two
# following lines:
#Defaults targetpw    # ask for the password of the target user i.e. root
#ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!

# Runas alias specification

GHELPDESK     LAN = SUDO

# User privilege specification
root    ALL=(ALL) ALL
%wheel  ALL=(ALL)       ALL
%infra ALL=(ALL)        ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h no

changes are in different color and in bold

So what did I do wrong?

And yes, user test exists on the server:

my-mnag0:/etc # finger test
Login: test                             Name: test
Directory: /home/test                   Shell: /bin/sh
Never logged in.
No Mail.
No Plan.
my-mnag0:/etc #

sagoiz · November 30, 2011, 8:11am

Hi again hedkandi, I think the mistake is under the line:

Defaults    logfile=/var/log/sudo.log, log_year

If I am not mistaken it should be:

Defaults    log_year, logfile=/var/log/sudo.log

Regards.

hedkandi · November 30, 2011, 10:39pm

Hi sagios

Thank you for the correction

I made the changes above but when i logged on as test user I am still not able to edit the sudoers file, I am getting permission denied & command not found error:

my-mnag0:~$ cd /etc
my-mnag0:/etc$ visudo
-sh: visudo: command not found
my-mnag0:/etc$ vi sudoers

---------- Post updated at 07:39 PM ---------- Previous update was at 07:36 PM ----------

and when a normal user attempted to "sudo su -" to become root it fails because of this parse error in sudoers file

my9849
my9849@my-mnag0:~> sudo su -
>>> sudoers file: syntax error, line 17 <<<
sudo: parse error in /etc/sudoers near line 17

my-mnag0:~ # visudo
Warning: undeclared Cmnd_Alias `SUDO' referenced near line 39

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

Host_Alias    LAN = my-mnag.os.itelligence.com.my

# User alias specification

User_Alias    GHELPDESK = test

# Cmnd alias specification

Cmnd_Alias    SUDO = visudo

# Defaults specification

Defaults    log_year, logfile=/var/log/sudo.log

# prevent environment variables from influencing programs in an
# unexpected or harmful way (CVE-2005-2959, CVE-2005-4158,
# CVE-2006-0151)
Defaults always_set_home
Defaults env_reset

# In the default (unconfigured) configuration, sudo asks for the root password.
# This allows use of an ordinary user account for administration of a freshly
# installed system. When configuring sudo, delete the two
# following lines:
#Defaults targetpw    # ask for the password of the target user i.e. root
#ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!

# Runas alias specification

GHELPDESK     LAN = SUDO

# User privilege specification
root    ALL=(ALL) ALL
%wheel  ALL=(ALL)       ALL
%infra ALL=(ALL)        ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now

so i had to login as root and revert all changes, would it work if i defined at the end of the sudoers file with specific commands for multiple users?

sagoiz · December 1, 2011, 3:02am

Hello again, you need to give complete path:

Cmnd_Alias    SUDO = /usr/sbin/visudo

And while running the command you still need to give the full path:

> sudo /usr/sbin/visudo

I would also recommend you to use Yast, I know you may not be used to it, but it works like a charm once you get confident with it.
You can find free training materials at the link below, they are a little bit old, but as you are dealing with SLES 10, you will not notice it.

Courses Available � Novell

Regards.

hedkandi · December 1, 2011, 4:24am

Hi sagios

mate i think you're right about yast

anyways I just amended what you had provided and guess what?

my-mnag0:~$ sudo /usr/sbin/visudo

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

test's password:
test is not allowed to run sudo on my-mnag0.  This incident will be reported.

do i have to add test user to sysadm group or something?

sagoiz · December 1, 2011, 4:58am

Hello, ok, this is what I did to reproduce your conf.

From your conf remove the line:

GHELPDESK     LAN = SUDO

Then to add a runas alias:

Runas_Alias    ROOT = root

Then add a user to allow the use of sudo:

GHELPDESK LAN = (ROOT) SUDO

Hope it works this time.

Regards.

hedkandi · December 1, 2011, 10:54pm

ugh! it failed again!

my-mnag0:~$ sudo /usr/sbin/visudo
test's password:
test is not allowed to run sudo on my-mnag0.  This incident will be reported.
my-mnag0:~$ date
Fri Dec  2 12:12:24 MYT 2011

# Host alias specification
Host_Alias    LAN = my-mnag.os.itelligence.com.my
# User alias specification
User_Alias    GHELPDESK = test
# Cmnd alias specification
Cmnd_Alias    SUDO = /usr/bin/visudo
# Defaults specification
Defaults    log_year, logfile=/var/log/sudo.log
# prevent environment variables from influencing programs in an
# unexpected or harmful way (CVE-2005-2959, CVE-2005-4158,
# CVE-2006-0151)
Defaults always_set_home
Defaults env_reset

# In the default (unconfigured) configuration, sudo asks for the root password.
# This allows use of an ordinary user account for administration of a freshly
# installed system. When configuring sudo, delete the two
# following lines:
#Defaults targetpw    # ask for the password of the target user i.e. root
#ALL ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!

# Runas alias specification
Runas_Alias     ROOT = root
# User privilege specification
root    ALL=(ALL) ALL
%wheel  ALL=(ALL)       ALL
%infra ALL=(ALL)        ALL

GHELPDESK LAN = (ROOT) SUDO
# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
#%test  localhost=/sbin/shutdown -h now

can we try with a different command? (i.e start stop a service such as httpd or something like that)

dude2cool · December 1, 2011, 11:42pm

why don't you try this , comment out the GHELPDESK line and replace it with:

test my-mnag0 = (root) /usr/sbin/viudo

or define your host_alias to be my-mnag0 instead of my-mnag0.os.itelligence.com.my

hedkandi · December 2, 2011, 4:07am

OMG that totally worked!

dude, you're too cool! haha thanks and thanked!

---------- Post updated 12-02-11 at 01:04 AM ---------- Previous update was 12-01-11 at 10:29 PM ----------

dude2cool:

why don't you try this , comment out the GHELPDESK line and replace it with:
test my-mnag0 = (root) /usr/sbin/viudo
or define your host_alias to be my-mnag0 instead of my-mnag0.os.itelligence.com.my

Sorry to be a bother, how do i make this work for multiple users? I added a second user separated with a comma but it didnt work for the second user "test2"

---------- Post updated at 01:07 AM ---------- Previous update was at 01:04 AM ----------

never mind i sorted that out, thanks

hedkandi · January 3, 2012, 9:07pm

Please close this thread