i'm using mac os x and i was trying to run shutdown command but it says
i'm not a superuser.
However, i could run ifconfig without being super user.
Both command are in /sbin.
And my PATH environment variable include /sbin ( is that why i can run ifconfig..?).
From what i have found, it says that
/sbin
for scripts with superuser (root) privileges required.
But i'm not quite sure about this explanation..
I'd appreciate all your help..
it means that you must be superuser (the owner of the machine) to run those commands, for example:
sudo shutdown
it will ask for a password, you must type the main user's password (the typing will not print out the password's chars) and press enter so you can confirm you are the super user.
sudo allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file. more: http://ss64.com/bash/sudo.html
Related
I'm running a bash command on mac that moves a file to private/etc/app_name/.
sudo cp my_file.cpp private/etc/app_name/
Every time the I want to run the bash file, the OS asks for my system password.
> ./run_copy.sh
Password: *******
Is there a way to by-pass this or configure in such way that I only have to enter the password once.
Apparently, on my Macbook, I see /etc directory having symlinks with the /private/etc directory which is owned by the wheel group & root is part of that group. So, you would need to use sudo to copy to that directory.
With that said on a Linux machine, you can work around this by adding your group to a new file in the /etc/sudoers.d/<group-name> path.
<grp-name> ALL=(ALL) NOPASSWD:ALL
I've just tried this on my mac, I could copy files onto /private/etc directory without entering the sudo password prompt.
Unfortunately, this comes up with some risks as users of your group get privileged access without entering any password prompt. You might accidentally delete important system files etc.,
A more niche approach could be to allow selectively like <group> ALL = (ALL) NOPASSWD: /usr/local/bin/copy-script. This way, they can't run all scripts/commands with sudo privileges.
• Here is the script to be executed via AppleScript:
bash-3.2$ cd /Users/jack/Desktop/
bash-3.2$ ls -l | grep static
-rwxrwxrwx 1 jack admin 65 5 May 08:10 static-routes.sh
bash-3.2$ cat static-routes.sh
#!/bin/bash
sudo route -n add -net 192.168.3.0/24 172.16.254.134
~
• AppleScript contains the following:
do shell script "~/Desktop/static-routes.sh"
• When executing the script from within an AppleScript, by clicking on "Run" button, pop up window saying:
Script Error
sudo: a terminal is required to read the password;
Either use the -S option to read from standard input or
configure an askpass helper
• When exeucuting script from the console without sudo, no additional prompts appear:
bash-3.2$: Desktop jack$ ./static-routes.sh
add net 192.168.3.0: gateway 172.16.254.134
• Here is the snippet from /etc/sudoers:
bash-3.2$ sudo visudo
# root and users in group wheel can run anything on any machine as any user
root ALL = (ALL) ALL
%admin ALL = (ALL) ALL
jack ALL = (ALL) NOPASSWD: /Users/jack/Desktop/static-routes.sh
## Read drop-in files from /private/etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /private/etc/sudoers.d
Defaults timestamp_timeout=60
Questions:
• Why this error is showing up, since, I have explicitly added the script to the sudoers file to be executed without password prompt via sudo?
• Which user does AppleScript use to execute the scripts? Is it possible to modify it?
The run a command that requires privileges from AppleScript, you need to specify that by adding the administrator privileges key, as in one of the following:
-- this will presented a standard authorization dialog
do shell script "~/Desktop/static-routes.sh" with administrator privileges
-- this will specifies an administrator account and password
-- (though note, the password will be visible as plain text in the script)
do shell script "~/Desktop/static-routes.sh" with administrator privileges user name XXXX password YYYY
You should not use sudo at the same time you use with administrator privileges; it's unnecessary and creates security holes. However, since you've changed the sudoers file already, you could try this:
do shell script "sudo ~/Desktop/static-routes.sh"
Putting sudo up front like that might cue AppleScript to do the correct thing.
See Technote 2065 for more information.
Was trying to figure out how to execute a sudo command with the password as a parameter.
echo mypassword | sudo -S command
was using this reference Use sudo with password as parameter
However, on OS X it keeps say "sudo: incorrect password attempt" however that passwords is correct.
what am i doing wrong?
As pointed out in the comments already, what you're doing is a very bad idea because it leaves the password of an account laying around. Instead, if you need to run a specific command with sudo from a script, you could -- and you should -- define that single command for one specific user in such a way that its execution is allowed without having to type in the password.
So, you should edit /etc/sudoers to include an entry for your specific user for that one, single, specific command with the tag NOPASSWD:
youruser yourhostname = (root) NOPASSWD: /some/path/your/command
Or if you really don't feel like typing in the hostname of your computer, then go for:
youruser ALL = (root) NOPASSWD: /some/path/your/command
That way you will possibly leak the ability of executing that one, single command as root instead of leaking your password and with it the possibility of running any commands as root.
I want to run the following sample bash script which needs sudo password for a command
#!/bin/bash
kinit #needs sudo password
vi hello.txt
while running the above script it is asking for password.
How can i pass the username and password in the command itself or is there any better way i can skip passing my password in the script ?
TL;DR
You can't—at least, not the way you think.
Longer Answer with Alternatives
You have a couple of options:
Authenticate interactively with sudo before running your script, e.g. sudo -v. The credentials will be temporarily cached, giving you time to run your script.
Add a specific command such as /usr/lib/klibc/bin/kinit to your sudoers file with the NOPASSWD option. See sudoers(5) and and visudo(8) for syntax.
Use gksudo(1) or kdesu(1) with the appropriate keyring to cache your credentials if you're using a desktop environment.
One or more of these will definitely get you where you want to go—just not the way you wanted to get there.
So if you have access to your full system, you can change your sudoers file to allow certain sudo commands to be run w/o a password.
On the command line run visudo
Find your user and change the line to look something like this:
pi ALL=(ALL) NOPASSWD: /path/to/kinit, /path/to/another/command
That should do it. Give it another shot!
Hope that helps
You shouldn't pass username and password. This is not secure and it is not going to work if the password is changed.
You can use this:
gksudo kinit # This is going to open a dialog asking for the password.
#sudo kinit # or this if you want to type your password in the terminal
vi hello.txt
Or you can run your script under root. But note that vi is going to be ran as root as well, which means that it will probably create files that belong to root, that might be not what you want.
This may be a stupid question.
I have a script that I want to be portable between Mac OS X and a Linux box I use. In OS X, a command in the script requires sudo, where on the Linux box, it does not.
Long story short, how does one run one command in a script with sudo, while then removing the elevated privileges for the rest of the script?
I have tried to use
su -
and
su -c
but they both seem to error out. (They say "sorry" and move on, I assume because it is trying to run as root and root does not have a password).
I know there has to be a silly and easy way to do this, what does everyone suggest?
You can 'revoke' the sudo permission (actually: close the sudo time window early) by doing:
sudo -k
Also, you can configure sudo to only allow elevated permissions on certain commands, or even to impersonate non-root for specific commands. See man sudoers. The examples section makes it exceedingly clear that there is virtually no limit to the configurability of sudo (roles, hosts, commands, allow escaping, allow sudo target users, exceptions to allowed things, password less authorization etc etc).
Hopefully an interesting example in your context:
The user fred can run commands as any user in the DB Runas_Alias (oracle or sybase) without giving a password.
fred ALL = (DB) NOPASSWD: ALL
If you can't / don't really want to meddle with /etc/sudoers (visudo!) then I suggest using something like
{
trap "sudo -k" EXIT INT QUIT TERM
sudo ls # whatever
}
Try sudo su instead of su to change back to a regular user.
Use sudo without su:
#!/bin/bash
whoami # Runs under your regular account
sudo whoami # Runs as root
whoami # Runs under your regular account again
Here's the output when I run it:
$ ./sudotest
gordon
Password:
root
gordon