Syntax for sudoers file for mv command


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Syntax for sudoers file for mv command
# 1  
Old 08-13-2019
Syntax for sudoers file for mv command

Hi,

On one of Solaris 10 server, apache service is running. Due to audit requirement, its error_log grows bigger and we are required to keep that. Sometimes it grows more than 200GB and fills up file-system.
Purpose is, if error_log touches 10GB, apache service should stop, error_log should move to error_log_xxxxxx and spache service start.
Application team wants to use a script, which looks straightforward. Below is part of that script
Code:
       logger -p user.alert "ChkProxyStatus.sh :: proxy_health_warning :: Apache error log was exceeding 10G. Restarting apache on $Server."
       mv $LatestErrorFile ${LatestErrorFile}_`date +%Y%m%d`
       /usr/local/bin/sudo /usr/sbin/svcadm restart svc:/site/network/http:apache2
       sleep  10
       Status=`/usr/bin/svcs |grep http | grep -c 'online'`

error_log is owned by root, so application user (which will run that script via his cron) will not be able to mv that file. If I can give 'sudo mv' to his id with absolute path, this should serve the purpose, I think.
But I am not able to figure out, what should be syntax in /etc/sudoers for mv command mentioned in above script.
Help please.

Thanks
# 2  
Old 08-13-2019
You can also run your script from the root users crontab and the problem is solved, and you can get rid of the sudo.

sudo is really overused, especially in situations where it is not necessary.

I have many similar scripts running that are executed by a crontab owned by root. It makes little sense to me to take these kinds of scripts and run them as a non-privileged user only to then sudo to get them to work. This just added extra complexity to the management of the system, in my view, for these kinds of log rotation scripts.
This User Gave Thanks to Neo For This Post:
# 3  
Old 08-14-2019
Sure, that would be one good option.
# 4  
Old 08-14-2019
Quote:
Originally Posted by ron323232
Sure, that would be one good option.
Cheers.

Managing servers for over 40 years, I try to keep things simple. To me, simplicity is elegance.

In addition, I normally never have enough time to do all the things I need to do with IT systems, so I like things simple, self-documenting, and easy to understand so when I go back and have to revisit things months later, it's easy to understand and make changes. In coding and sys admin, I like self-documenting and descriptive, not cryptic or pedantic.

Naturally, you will need to make sure any scripts that are run from the root user cron are only writeable, executable and perhaps only readable by root. The requirement would be similar if you set it up for sudo, but it's similar to just run it from the root crontab.

sudo mostly give you logging when "people" sudo to execute a privileged command, but since you know that root needs to execute this process in cron, you really don't need sudo for this.

Don't let sudo become a "religion" for your system admin work (as some on the net would want to to "believe")
# 5  
Old 08-14-2019
You can delegate SMF permissions for specified service to a user.
A user can be set to stop / start / restart svc:/site/network/http:apache2 specifically.

Check out the resources online so i don't paste the obvious search engine output.

Hope that helps.
Regards
Peasant
# 6  
Old 08-14-2019
If you have a suitable Operating System, which would be very useful to know, have you considered using logrotate for this? You can write a stanza that tells the process what to do and it can be based on size or various other things.

You could schedule this against your own configuration file more frequently than the default 'once overnight' that probably already runs to manage things in /var/log


Would that be a way forward? You can probably re-use a stanza from /etc/logrotate.conf to get you started.



I hope that this helps,
Robin
# 7  
Old 08-15-2019
Delegating SMF permissions and using logroate is also good options. I will check, what would be most suitable for their needs. Thanks for suggestions.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Sudoers file

In the sudoers file in Solaris... I am trying to limit the DEVELOPER user privileges to where those users can only use the “rm” command in certain directories. This is to prevent them from deleting directories or files and destroying a server. I want them to be able to use the "rm" command but... (1 Reply)
Discussion started by: nzonefx
1 Replies

2. UNIX for Dummies Questions & Answers

Help with Sudoers file

Hi using Solaris 10. trying to update /etc/sudoers file I need to add all the fist level operation team. This is what I have but it doesn't seem to work. Please help.Error message sudo su - >>> sudoers file: parse error, line 9 <<< >>> sudoers file: parse error, line 9 <<< ... (2 Replies)
Discussion started by: samnyc
2 Replies

3. Emergency UNIX and Linux Support

Getting details from sudoers file

Hi, I need the details of which ids belong to the sudoers file, and which groups these ids belong to. Can anyone suggest a way to derive that information into a flat file please? G (4 Replies)
Discussion started by: ggayathri
4 Replies

4. UNIX for Dummies Questions & Answers

Pls. help with sudoers file...

Hi, I was asked to create sudoers file for operation team so they can sudo as another user and run few commands. I have updated /etc/sudoers file. User_Alias LEVEL1 = JamesF, dennisW, juanC, steveS, Cmnd_Alias SU_PROD=/bin/su prod, /bin/su - prod Cmnd_Alias SU_NYOP=/bin/su... (2 Replies)
Discussion started by: samnyc
2 Replies

5. Cybersecurity

Help with sudoers file - AIX

Hi all, I'm trying to setup my sudoer file at work to have the right security, but I'm not able to refine to the level I want. Here's what I would like to have: => OS Users - John (group staff) - Bob (group staff) - app20adm (group app20grp) - app70adm (group app70grp) - sys20adm... (0 Replies)
Discussion started by: victorbrca
0 Replies

6. UNIX for Dummies Questions & Answers

how to take backup of a file , tell command and syntax

how to take backup of a file , tell command and syntax (1 Reply)
Discussion started by: sunilamarnadh
1 Replies

7. UNIX for Advanced & Expert Users

sudoers file

i have defined a rule in the sudoers file so a specific user is able to run some commands as sudo with no password. my question is: is it possible to restrict a user to run commands as sudo only in a certain directory? for example: chown only the files that are located in /var/tmp. Thank you. ... (2 Replies)
Discussion started by: noam128
2 Replies

8. UNIX for Advanced & Expert Users

sudoers syntax

I'm stuck with a dilemma. I am trying to control userid's access to the su command in such a way that he will not be able to su to root (su, su -, su root, su - root) but he will be able to su to any other user. I have tried the following syntax: userid ALL=/usr/bin/su ?*, !/usr/bin/su *root*... (2 Replies)
Discussion started by: chuckuykendall
2 Replies

9. Solaris

sudoers file not found

root@dervish # cat /etc/sudoers cat: cannot open /etc/sudoers This is what I get when I try to search for the sudoers files. I want to create a user by name jda and assign him root privileges. How can I do that using sudo command and editing sudoers file. Please help me. (12 Replies)
Discussion started by: bharu_sri
12 Replies

10. Linux

sudoers file

Hi, I have edited 'sudoers' file to allow 'cads' user shutdown the system without providing a password. Can someone tell me what's wrong with my file? It's not working when I 'sudo SHUTDOWN' command: sudo: SHUTDOWN: command not found Thanks a lot! # Host alias specification... (4 Replies)
Discussion started by: whatisthis
4 Replies
Login or Register to Ask a Question