1

I've been trying to run sudo commands as exec resources with no luck. First I was getting the "sorry, you must have a tty to run sudo" message and I'm now getting "no tty present and no askpass program specified". This is what @i'm currently running for illustration purposes:

[dan@kyvltvm00022 tests]$ puppet apply ./test.pp 
Notice: Compiled catalog for kyvltvm00022.bfredb.com in environment production in 0.07 seconds
Notice: /Stage[main]/Main/Exec[testing sudo]/returns: sudo: no tty present and no askpass program specified
Error: /usr/bin/sudo su - fred -c "/usr/bin/echo \"hola dan\" > /home/fred/unaprueba" returned 1 instead of one of [0]
Error: /Stage[main]/Main/Exec[testing sudo]/returns: change from notrun to 0 failed: /usr/bin/sudo su - fred -c "/usr/bin/echo \"hola dan\" > /home/fred/unaprueba" returned 1 instead of one of [0]
Notice: Finished catalog run in 0.13 seconds
[dan@kyvltvm00022 tests]$ cat ./test.pp 
exec { 'testing sudo':
  command => '/usr/bin/sudo su - fred -c "/usr/bin/echo \"hola dan\" > /home/fred/unaprueba"',
}
[dan@kyvltvm00022 tests]$ sudo cat /etc/sudoers
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
## 
## This file must be edited with the 'visudo' command.

## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using 
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2

## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem


## Command Aliases
## These are groups of related commands...

## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb

## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 

## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe

# Defaults specification
#Cmnd_Alias NOTTYCMD = /usr/bin/echo "hola dan" > /home/fred/unaprueba

#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
#         You have to run "ssh -t hostname sudo <cmd>".
#
#Defaults   requiretty

Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on 
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
##  user    MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere 
root    ALL=(ALL)   ALL
dan ALL=(ALL)   NOPASSWD: ALL
#puppet ALL=(ALL)   NOPASSWD: ALL
#dan    ALL=(ALL)   NOPASSWD: /usr/bin/su -fred -c *

## Allows members of the 'sys' group to run networking, software, 
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)   ALL

## Same thing without a password
# %wheel    ALL=(ALL)   NOPASSWD: ALL

## Allows members of the users group to mount and unmount the 
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
[dan@kyvltvm00022 tests]$

Any help or ideas on how to achieve this will be extremely helpful.

Thanks

1
  • Puppet must work as root. Run sudo puppet apply ./test.pp, if you start it local.
    – mr_tron
    Jun 23, 2014 at 15:15

1 Answer 1

1

To use sudo non-interactively, the invoking user needs a NOPASSWD: entry in sudoers

%wheel    ALL=(fred) NOPASSWD: /usr/bin/echo "hola dan"

Then

sudo -u fred /usr/bin/echo "hola dan"

Note that I used sudo -u in favor of sudo su -.

Apart from all that, it is good practice with Puppet to actually deploy wrapper scripts that your exec resources can just invoke which will drop their priviliges of their own accord when they notice that they are run as root. If it makes you feel more secure, you can just invoke them through su -u <user>, that is still simpler than a sudo based approach, as your Puppet agent should run as root in any case.

1
  • Thanks felix. Mine was a very specific setup where puppet is not run as root and after ensuring that settings for users in group wheel were correct and no requiretty was set for the user everything went ok
    – dan
    Jun 24, 2014 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.