Sudo help needed

blane · #1 (**permalink**) 10-24-2008

Scenario: I have two servers, A and B. Server A is using autosys to connect to server B via ssh in order to run scripts. The scripts to be run on server B must be run by user "weblogic".

So what I did was make the autosys user connect with a ssh key from server A to server B. After that I gave sudo permissions to autosys so that it may run commands as weblogic. Here's my excerpt from visudo:

Code:

User_Alias      SU_AUTOSYS = autosys
Cmnd_Alias    AUTOSYS_SU = /usr/bin/su - weblogic
SU_AUTOSYS    ALL = NOPASSWD: AUTOSYS_SU

To further facilitate the automating I wrote a small script (runasweblogic.sh) that should automate the sudo <cmd> process:

Code:

#!/bin/sh
args="$@"
sudo su - weblogic  $args

I am thinking now that server A could connect to server B and run commands as weblogic in this manner:

Code:

ssh serverB "/opt/home/autosys/runasweblogic.sh  /opt/weblogic/whateverscript.sh"

This isn't working at all and is giving errors such as, "Sorry, user autosys is not allowed to execute /usr/bin/su - weblogic /opt/weblogic/whateverscript.sh" as root on serverB

Any ideas? I'm going nuts here...

blane · #2 (**permalink**) 10-24-2008

One more thing. If I login to server B as autosys and run "sudo su - weblogic", it works.

otheus · #3 (**permalink**) 10-24-2008

Yeah, if you provide arguments for a particular sudo command to run, it can run only with those arguments. So it probably works just to do "sudo su - weblogic" but any additional arguments make a different command. Add a star to let the command be run with an argument.

But this isn't what you really want. What you really want is sudo configured to run the command as weblogic and bypass su altogether:

Code:

#!/bin/sh
exec sudo -u weblogic -H "$@"

And your sudoers file like:

Code:

ALL    ALL = (weblogic) NOPASSWD: /opt/weblogic/whateverscript.sh

blane · #4 (**permalink**) 10-24-2008

Actually, I went a little further than that just for security, and now it's working.

Here's the entry in the sudoers file now:

Code:

autosys        ALL =(weblogic) /opt/home/autosys/test.sh, /opt/weblogic/wls92/domains/dev05/batch/*.sh, /opt/weblogic/wls92/domains/dev05/*.sh

I removed the others and figured I'd just go this way since you can obviously ensure only certain files are run as weblogic.

Thanks for the assistance! I should have done it this way in the first place.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
sudo	sydney2008	UNIX for Dummies Questions & Answers	3	08-25-2008 02:34 AM
sudo, or not sudo: that is the question	iBot	UNIX and Linux RSS News	1	02-07-2008 01:40 PM
using sudo in HP-UX	yoavbe	Shell Programming and Scripting	1	07-17-2006 08:54 AM
sudo	omran	UNIX for Advanced & Expert Users	2	09-29-2002 01:57 AM
How to use SUDO	syedifti	UNIX for Dummies Questions & Answers	1	10-29-2001 01:40 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread:


	Powered by