2

Recently I have been messing around with Docker/Jenkins to learn more about CI/CD workflows. I am aiming to have a process that takes pushes from github, builds the code and releases a JAR file to a remote server for further deployment.

I have been using the Jenkins SSH Pipeline Steps Plugin which has allowed me to SSH into my remote server to execute commands.

Here is the Deployment stage which involves the commands that I want to execute:

stage("Deploying") {
            steps {
                script {
                    withCredentials([sshUserPrivateKey(credentialsId: 'e48b15ad-0f5e-4f07-8706-635c5250fa29', keyFileVariable: 'identity', passphraseVariable: '', usernameVariable: 'jenkins')]) {
                      remote.user = jenkins
                      remote.identityFile = identity

                      sshCommand remote: remote, command: 'cd Winston-Bot/; sudo ./kill_winston.sh'
                      sshCommand remote: remote, command: 'rm Winston-Bot/*.jar', failOnError:'false'
                      sshCommand remote: remote, command: 'rm -rf Winston-Bot/src', failOnError:'false'
                      sshPut remote: remote, from: "target/Winston-Bot-${VERSION}-jar-with-dependencies.jar", into: 'Winston-Bot/'
                      sshPut remote: remote, from: "src", into: 'Winston-Bot/'
                      sshCommand remote: remote, command: "echo ${VERSION} > Winston-Bot/version.txt"
                    }
                }
            }
        }

When executing cd Winston-Bot/; sudo ./kill_winston.sh I receive the following error:

Executing command on ****[51.159.152.230]: cd Winston-Bot/; sudo ./kill_winston.sh sudo: false

sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
Failed command ****#15 with status 1: cd Winston-Bot/; sudo ./kill_winston.sh

I have already added the jenkins user group to the etc/sudoers with the following code:

jenkins ALL=(ALL) NOPASSWD: /var/lib/jenkins/Winston-Bot/.kill_winston.sh

The script executes perfectly fine when logged into my remote server as user jenkins through a terminal and does not require a password. Can anyone help me out with this?

2 Answers 2

6

I'm not sure it will be relevant for you but I had the exact same problem on macOS Big Sur. No matter how I edited the sudoers file with sudo visudo it simply wouldn't work.

The moment I've created and edited the right file it started working immediately: sudo visudo -f /etc/sudoers.d/jenkins

jenkins ALL=(ALL) NOPASSWD: ALL

I've got the idea from this comment and this answer.

1
  • Thank you so much for this answer! ran sudo -l -U jenkins before and after adding this new file: BEFORE; User jenkins may run the following commands on [server name]: (ALL) NOPASSWD: ALL (ALL : ALL) ALL After running: (ALL) NOPASSWD: ALL (ALL : ALL) ALL (ALL) NOPASSWD: ALL
    – AdamE
    Commented Nov 29, 2022 at 2:02
1

I had the same problem: works fine and am not prompted for sudo password while using SSH via a terminal, but when running via a Jenkins job using SSH keys, got the error:

sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper sudo: a password is required

The fix proposed by @farkasseb works for me also, and is probably the best solution, especially given this note at the top of the sudoers file which encourages this:

# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.

But I still wanted to understand more about why this was happening. What I also found out is that it matters where (the location) in the visudo / sudoers file where I place:

jenkins ALL=(ALL) NOPASSWD: ALL

If it is placed directly after root, then the issue is reproduced via jenkins SSH but not via terminal SSH. If it is placed AFTER the definition of the %admin and %sudo group, then I am no longer prompted for password when running via jenkins.

So, moving the jenkins user declaration downwards in the sudoers file results in the following order of permissions when listing the permissions for the jenkins user using this command:

sudo -l -U jenkins

From this:

(ALL) NOPASSWD: ALL
(ALL : ALL) ALL

To this:

(ALL : ALL) ALL
(ALL) NOPASSWD: ALL

I'm assuming that because NOPASSWD is last, that it has precedence? The following is a complete snippet from the sudoers file which does not prompt for password via jenkins:

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# add in jenkins user AFTER the sudo and admin group
jenkins ALL=(ALL) NOPASSWD: ALL

# See sudoers(5) for more information on "@include" directives:
@includedir /etc/sudoers.d

In the end, I can conclude that by using the sudo visudo -f /etc/sudoers.d/jenkins command to create a separate file that gets included by the @includedir /etc/sudoers.d results in the jenkins ALL=(ALL) NOPASSWD: ALL permission coming last too, which has the same effect as above.

What I still don't understand is why or how this could result in different behavior when running via Jenkins SSH vs terminal SSH?

In any event, if you don't want to modify the sudoers file directly, use the approach by @farkasseb (which has other advantages apparently when upgrading the OS). If it's OK for you to modify the sudoers file directly, then you can use this approach, just make sure the NOPASSWD part comes last, after the group definitions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.