Announcement

Collapse
No announcement yet.

sudoers edits not working?

Collapse
This topic is closed.
X
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    sudoers edits not working?

    This worked in 15.04 but doesn't work in 16.04. Anyone else use sudoers?

    My added file under /etc/sudoers.d/ named apt :
    Code:
    stuart office = (root) NOPASSWD: /usr/bin/apt-get
    stuart office = (root) NOPASSWD: /usr/bin/apt
    stuart office = (root) NOPASSWD: /usr/bin/add-apt-repository
    stuart office = (root) NOPASSWD: /usr/bin/apt-add-repository
    Like I said - worked perfectly with 15.04, here no workie. I even re-booted.

    Please Read Me

    #2
    What is it you are trying to accomplish?
    Windows no longer obstructs my view.
    Using Kubuntu Linux since March 23, 2007.
    "It is a capital mistake to theorize before one has data." - Sherlock Holmes

    Comment


      #3
      is your file mode 0440 (owner read, group read , others forbidden , owner root group root) ,,,,,,

      did you use visudo to make it ?

      EDIT: ,,,look at /etc/sudoers and uncoment the line "#includedir /etc/sudoers.d"

      VINNY
      Last edited by vinnywright; May 03, 2016, 06:57 PM.
      i7 4core HT 8MB L3 2.9GHz
      16GB RAM
      Nvidia GTX 860M 4GB RAM 1152 cuda cores

      Comment


        #4
        Paul: Using apt and apt-get and those two other from the CLI without entering my password.

        Vinny: Yes, I used visudo -f and the permissions are correct. If you try and remover the remark hash from that line it causes an error in the sudoers file and visudo advises you not to save it. I believe the comment is there to remind you not to edit sudoers and to instead do what I did - create the file in /etc/sudoers.d.

        The reason I posted this is the configuration is exactly the same as I have it in 15.04. There it works. Here on 16.04 it does not. I wondered if anyone else had tried this and had success before I continued to dig.

        Please Read Me

        Comment


          #5
          BTW, unrelated to this thread I just had a glitch due to a monitor blanking that caused me to have to log out. Once I had the keyboard and mouse weren't being read. So I pushed the power button, the system shut itself down, I rebooted, logged in, all in less than a single minute! Wow, this 16.04 is really much quicker than previous versions. I get the plymouth "pulse" of blue with the Kubuntu logo exactly once before it moves past plymouth.

          Please Read Me

          Comment


            #6
            Originally posted by oshunluvr View Post
            The reason I posted this is the configuration is exactly the same as I have it in 15.04. There it works. Here on 16.04 it does not. I wondered if anyone else had tried this and had success before I continued to dig.
            I'll fire up my 16.04 VM and check this out.
            Windows no longer obstructs my view.
            Using Kubuntu Linux since March 23, 2007.
            "It is a capital mistake to theorize before one has data." - Sherlock Holmes

            Comment


              #7
              Originally posted by oshunluvr View Post
              Vinny: Yes, I used visudo -f and the permissions are correct. If you try and remover the remark hash from that line it causes an error in the sudoers file and visudo advises you not to save it. I believe the comment is there to remind you not to edit sudoers and to instead do what I did - create the file in /etc/sudoers.d.
              No, that is not the reason. The line #includedir /etc/sudoers.d is a directive; It isn't a commented line. Check out the man page -- man sudoers -- and search for #includedir.

              According to the man page:
              When sudo reaches this line it will suspend processing of the current file (/etc/sudoers) and switch to /etc/sudoers.local. Upon reaching the end of /etc/sudoers.local the rest of /etc/sudoers will be processed. Files that are included may themselves include other files. A hard limit of 128 nested include files is enforced to prevent include file loop.
              So it would seem to me that your (apt) needs to be renamed to sudoers.apt (located in /etc), and that it would get processed with the entry #include sudoers.apt in sudoers.local, i.e:

              /etc/sudoers.local contains:

              #include sudoers.apt

              That's how I interpret it.
              Last edited by Snowhog; May 04, 2016, 06:04 PM.
              Windows no longer obstructs my view.
              Using Kubuntu Linux since March 23, 2007.
              "It is a capital mistake to theorize before one has data." - Sherlock Holmes

              Comment


                #8
                sweet a C style include so is // or /* */ treated as a line/ block comment? Who does that ? i mean really just about ever other config uses the # as a comment way to screw with the users sudo devs..
                Mark Your Solved Issues [SOLVED]
                (top of thread: thread tools)

                Comment


                  #9
                  So why so I have to build yet another sudoers location and add another directive? Why can't we use the one already provided for this purpose - /etc/sudoers.d ??

                  The README in /etc/sudoers.d/

                  stuart@office:~$ sudo cat /etc/sudoers.d/README
                  #
                  # As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
                  # installation of the package now includes the directive:
                  #
                  # #includedir /etc/sudoers.d
                  #
                  # This will cause sudo to read and parse any files in the /etc/sudoers.d
                  # directory that do not end in '~' or contain a '.' character.
                  #
                  # Note that there must be at least one file in the sudoers.d directory (this
                  # one will do), and all files in this directory should be mode 0440.
                  #
                  # Note also, that because sudoers contents can vary widely, no attempt is
                  # made to add this directive to existing sudoers files on upgrade. Feel free
                  # to add the above directive to the end of your /etc/sudoers file to enable
                  # this functionality for existing installations if you wish!
                  #
                  # Finally, please note that using the visudo command is the recommended way
                  # to update sudoers content, since it protects against many failure modes.
                  # See the man page for visudo for more information.
                  #
                  Note the bold text which states "any files" which also leads me to believe the naming is not critical. Either that or this is the most poorly worded README Debian has put out. Also note the inclusion of a period in the filename prevents it from being read (in this directory) so I don't agree that using sudoers.apt will work, unless you go through the unnecessary (IMO) extra step of creating yet another directory for extra sudoers files.

                  Finally, as I stated - I have configured 16.04 in exactly the same way as I did in 15.04 and it works in 15.04 but not in 16.04.

                  I will try the suggestion as a test, but clearly - to me at least - there is a bug if it worked in 15.04 but doesn't in 16.04 unless they configured it differently and did not document it.

                  Please Read Me

                  Comment


                    #10
                    I have tried the following:

                    1. Added a directive line pointing directly to my apt file - #include /etc/sudoers.d/apt
                    2. Added a directive pointing to an additional location as suggested - #includedir /etc/sudoers.local
                    3. Copied the apt file to /etc/sudoers.local/sudoers.apt as suggested.

                    Still does not work.

                    I even rebooted, although I doubt that's necessary.

                    Please Read Me

                    Comment


                      #11
                      If I understand correctly, you are trying to (have done previously) create specific command aliases that can run without being prompted for the elevated privileges password. If so, then maybe Command Aliases is appropriate?
                      Windows no longer obstructs my view.
                      Using Kubuntu Linux since March 23, 2007.
                      "It is a capital mistake to theorize before one has data." - Sherlock Holmes

                      Comment


                        #12
                        There is clearly something wrong with my install, not with my edits. I re-booted into 15.04 and re-did /etc/sudoers.d/apt - works like a charm as it always did. Then I booted my 16.04 VM and created /etc/sudoers.d/apt and IT works like a charm. Still here - nothing.

                        Same file contents on all three install with different results on just this one. I may have to do another 16.04 install on this machine and test it next.

                        Please Read Me

                        Comment


                          #13
                          with your third attempt did you try /etc/sudoers.local/apt (without the . )
                          Mark Your Solved Issues [SOLVED]
                          (top of thread: thread tools)

                          Comment


                            #14
                            No, but everything I've tried works everywhere I've tried it except on this one install. I honestly don't think it's a problem with sudoers or any of the associated functionality. The problem is with this particular installation.

                            I'm past re-attempting more with this install as clearly it just doesn't work. I'm trying to figure out if there's a way to trace what's happening (or not) but I've had no luck. visudo parses all the files when doing a check and reports no issues. I've even re-built the apt file in hopes the problem was a non-printing character. I also re-built to apt file on the 15.04 install several times using different ways to accomplish the same thing and they ALL worked but NONE of them work here.

                            I'm curious to see if the file is being read and just ignored or if it's not being read at all. I may have time Saturday morning to do a second install of 16.04 on this machine and see if it's just a fluke.

                            Please Read Me

                            Comment


                              #15
                              Update on this issue: New 16.04 install and it still doesn't work. However, when I changed the hostname from "office" to "ALL" is worked. So it appears the problem lies somewhere with sudoers reading the hostname. As I stated several times, using "office" in the sudoers file works in 15.04. I posted a bug here: https://bugs.launchpad.net/ubuntu/+s...e/+bug/1584549 but it appears no one has looked at it yet.

                              Please Read Me

                              Comment

                              Working...
                              X