Header RSS Feed
If you only want to see the articles of a certain category, please click on the desired category below:
ALL Android Backup BSD Database Hacks Hardware Internet Linux Mail MySQL Monitoring Network Personal PHP Proxy Shell Solaris Unix Virtualization VMware Windows Wyse

sudo asks for password, although NOPASSWD is set in /etc/sudoers
Friday - Oct 30th 2015 - by - (0 comments)

On an Ubuntu 14.04 I tried to change to another user with the sudo command, but sudo asked me for a password:

claudio@ubuntu:~$ sudo -u ansible /bin/bash
[sudo] password for claudio:

Strange... I explicitely defined in /etc/sudoers that my user is able to launch commands as ansible without having to enter a password:

claudio ALL=(ansible) NOPASSWD:/bin/bash

On my research I came across a question on stackexchange. Although it was directed to an OSX system, the issue was the same.
Turns out, my user "claudio" is part of the "sudo" group:

claudio@ubuntu:~$ grep claudio /etc/group

In /etc/sudoers there is already a pre-configured rule (at least in Ubuntu) which is set for the sudo group:

root@ubuntu:~# grep ^%sudo /etc/sudoers
%sudo  ALL=(ALL:ALL) ALL

And here there is no mention of NOPASSWD. The group entry in sudoers seems to override the user entry.
On this particular server I don't make use of the "sudo" group, so I disabled this entry in /etc/sudoers. And now it works:

claudio@ubuntu:~$ sudo -u ansible /bin/bash

Side note:

When I launched the ansible-playbooks after having changed to the ansible user with the sudo command above, I experienced problems that my real user "claudio" was used. This is because some environment variables are still set to my own user if I use "sudo -u $user /bin/bash".

ansible@ubuntu:/srv/ansible$ ansible-playbook playbooks/test/testplay.yaml

PLAY [ANSIBLE - Test Playbook v.0.1] *******************************

GATHERING FACTS ***************************************************************
fatal: [ansibleclient.local] => Could not make dir /home/claudio/.ansible/cp: [Errno 13] Permission denied: '/home/claudio/.ansible'

To prevent this problem, a real login as the destination user should be made like this:

claudio@ubuntu:~$ sudo -i -u ansible

The relevant sudoers entry was adapted a little bit:

claudio  ALL=(ansible) NOPASSWD: ALL


Add a comment

Show form to leave a comment

Comments (newest first):

No comments yet.

Go to Homepage home
Linux Howtos how to's
Monitoring Plugins monitoring plugins
Links links

Valid HTML 4.01 Transitional
Valid CSS!
[Valid RSS]

6939 Days
until Death of Computers