{"id":4166,"date":"2019-09-14T20:59:41","date_gmt":"2019-09-14T17:59:41","guid":{"rendered":"https:\/\/kifarunix.com\/?p=4166"},"modified":"2024-03-12T21:55:40","modified_gmt":"2024-03-12T18:55:40","slug":"run-only-specific-commands-with-sudo-in-linux","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/run-only-specific-commands-with-sudo-in-linux\/","title":{"rendered":"Run only Specific Commands with sudo in Linux"},"content":{"rendered":"\n<p>In this guide, you are going to learn how to run only specific commands with sudo in Linux.<\/p>\n\n\n\n<p>Our previous guide covered how to add user to sudo group to enable them to execute the commands with elevated privileges.<\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/how-to-add-users-to-sudo-group-in-linux\/\" target=\"_blank\">How to Add Users to sudo group in Linux<\/a><\/p>\n\n\n\n<p>So it is possible to enable a user to run specific commands only with sudo in Linux. This can be done by modifying the <code>\/etc\/sudoers<\/code> file or by adding user specific sudoers configuration file under the <code>\/etc\/sudoers.d<\/code> directory.<\/p>\n\n\n\n<p>For example, to allow a user called john to restart Network Manager as user root on all hosts, edit the sudoers file and add the line below.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>visudo<\/code><\/pre>\n\n\n\n<p>To edit sudoers file, you need to be root user or have sudo privileges.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo visudo<\/code><\/pre>\n\n\n\n<p>Next, add the line below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>john ALL=(root) \/bin\/systemctl restart NetworkManager<\/code><\/pre>\n\n\n\n<p>To run specific commands with sudo as any target user, for example to allow user john to restart only Apache service using sudo;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>john ALL=(ALL) \/bin\/systemctl restart apache2<\/code><\/pre>\n\n\n\n<p>Note that while adding sudo privileges for the user, it is more safer to put the user specific sudo configuration under the&nbsp;<code>\/etc\/sudoers.d<\/code>&nbsp;directory for example;<\/p>\n\n\n\n<p><em><strong>NOTE<\/strong>: Be extra cautions when echoing commands. You can easily mess up and loose sudo access to your system. Unless the root user is allowed to login, you can try to use echo.<\/em><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo \"john ALL=(root) \/bin\/systemctl restart apache2\" &gt; \/etc\/sudoers.d\/john<\/code><\/pre>\n\n\n\n<p>Always be sure to confirm if the syntax of the sudo configs is okay when you echo commands;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>visudo -c \/etc\/sudoers.d\/john<\/code><\/pre>\n\n\n\n<p>Ensure the output is Ok. Otherwise, fix any would be errors.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/sudoers.d\/john: parsed OK<\/code><\/pre>\n\n\n\n<p>To check the validity of all sudoers config files;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>visudo -c<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/sudoers: parsed OK\n\/etc\/sudoers.d\/README: parsed OK\n\/etc\/sudoers.d\/eliza: bad permissions, should be mode 0440\n\/etc\/sudoers.d\/john: parsed OK<\/code><\/pre>\n\n\n\n<p>To allow a specific user to run multiple specific commands with sudo;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>john ALL=(ALL) <strong>\/path\/to\/command1, \/path\/to\/command2, \/path\/to\/command3<\/strong><\/code><\/pre>\n\n\n\n<p>Replace <code>\/path\/to\/command<\/code> with the full path of the commands to run and the arguments (if any).<\/p>\n\n\n\n<p>You can find the full path of the command using <code>which<\/code> command. For example to locate the full path of the command, command1;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>which command1<\/code><\/pre>\n\n\n\n<p>You can then run these commands by prefixing them with sudo as in;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo systemctl restart NetworkManager<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo systemctl restart command1<\/code><\/pre>\n\n\n\n<p>For all these commands, you will be prompted to the password for user with which you run these commands as.<\/p>\n\n\n\n<p>Want to run some commands sudo without being prompted for password?<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Run sudo Commands Without a Password<\/h3>\n\n\n\n<p>sudo has an option called <code>NOPASSWD<\/code> that can be used to specify commands that can be run as sudo without being prompted for the password.<\/p>\n\n\n\n<p>For example, to enable user called&nbsp;<code>john<\/code>&nbsp;to restart Network Manager on an Ubuntu system as any user without being prompted for password, at the line below to sudoers file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>john ALL=(ALL) NOPASSWD: \/bin\/systemctl restart NetworkManager<\/code><\/pre>\n\n\n\n<p>To restart NetworkManager as any target user and group, add the line below to sudoers file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>john ALL=(ALL:ALL) NOPASSWD: \/bin\/systemctl restart NetworkManager<\/code><\/pre>\n\n\n\n<p>You can simply put this line to user specific sudoers file as follows;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>visudo -f \/etc\/sudoers.d\/john<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>john ALL=(ALL) NOPASSWD: \/bin\/systemctl restart NetworkManager<\/code><\/pre>\n\n\n\n<p>To restart the Network Manager with sudo;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart NetworkManager<\/code><\/pre>\n\n\n\n<p>To run all sudo commands without password prompt as any user,group on all hosts, enter the line below in sudoers file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>username ALL=(ALL:ALL) NOPASSWD:ALL<\/code><\/pre>\n\n\n\n<p>In this guide, you have learnt how to;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>run only specific commands using sudo in Linux<\/li>\n\n\n\n<li>run sudo commands without a password<\/li>\n<\/ul>\n\n\n\n<p>Other tutorials;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-add-users-to-sudo-group-in-linux\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">How to Add Users to sudo group in Linux<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/how-to-schedule-cron-jobs-tasks-in-linux-unix\/\" target=\"_blank\">How to Schedule Cron Jobs\/Tasks in Linux\/Unix<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/configure-apt-proxy-on-debian-10-buster\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Configure APT Proxy on Debian 10 Buster<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this guide, you are going to learn how to run only specific commands with sudo in Linux. Our previous guide covered how to add<\/p>\n","protected":false},"author":1,"featured_media":14089,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,49,1123],"tags":[5837,1107,1130,1124,1125,1128,5838,5839],"class_list":["post-4166","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-command-cheatsheets","category-sudo","tag-check-sudoers-file-syntax","tag-linux","tag-nopasswd","tag-sudo","tag-sudoers","tag-sudoers-file","tag-visudo","tag-visudo-check","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4166"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=4166"}],"version-history":[{"count":7,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4166\/revisions"}],"predecessor-version":[{"id":21201,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4166\/revisions\/21201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/14089"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=4166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=4166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=4166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}