Re: (Hopefully) quick policy question

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3483600317042141790==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------JHzcu8CSsphSJ0ItM1dzZ09h"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------JHzcu8CSsphSJ0ItM1dzZ09h
Content-Type: multipart/mixed; boundary="------------6mintjRe0rMCcXbTMbcBbBdl";
 protected-headers="v1"
From: Mihai Moldovan <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [sudo-users] (Hopefully) quick policy question
References: <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--------------6mintjRe0rMCcXbTMbcBbBdl
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

* On 9/27/23 16:03, Jore wrote:
> Thanks for that.
>=20
> Okay, so here's what I've tried:
>=20
>     [...]
>      =C2=A0 sudo /usr/bin/bash /root/acme.sh/acme.sh --force --issue --=
domain
>     "${domain}" --webroot /var/lib/ssl/
>     [...]
>=20
>     root@test:~# cat /etc/sudoers.d/test
>     test ALL =3D NOPASSWD: /usr/bin/bash /home/test/acme-wrapper.sh *
>=20
>=20
> And now logging in as test user:
>=20
>     test@test:~$ bash /home/test/acme-wrapper.sh foo.example.com
>     [sudo] password for test:
>     sudo: a password is required

No, that's exactly the wrong way around.

Keep the call to /root/acme.sh/acme.sh (or /root/.acme.sh/acme.sh?) witho=
ut a
prepended sudo call and, as the normal user, call "sudo bash
/home/test/acme-wrapper.sh foo.example.com". Your sudoers file is already=

correctly set up for that to work.



Mihai

--------------6mintjRe0rMCcXbTMbcBbBdl--

--------------JHzcu8CSsphSJ0ItM1dzZ09h
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEbhHQj3UzgcdE8cg8H9Yu2W4lOocFAmUUOkoFAwAAAAAACgkQH9Yu2W4lOocn
ERAAoKexCplx8ckGAgFFm872fqi2IR6zWOb9BDIc9xh9WWCV6lFu4cETlkepadyiOvWFZFtzMoeK
GesRFC4hnjcwaJIioRU52mWHpY4w+H0yFE3O0c0l2Qb6o/lSoaR8UWXR9Y6FN8LBCjX+TIaiB4NC
ibvUo1iOFdVadyqd0xoqbADVL8QjtMUXOW/aTa1b3Wn2T+I25Th+ceK+jspsqODGIPlaEZWih5lK
LJJn6E818xUYG43Zy7IGlsRqWNqsZ99uGGB1Het9iGchcJPND8E49hLITel1s4orGNNyviz93DFB
2ZqoEYTTJggUBE+lR56nXjrAuLr4Rtg+gzKVNrUoYbJI4YNw/jtnjKXLbQzGM/QsiK6yNkMRW3YA
7+rEtPc7Ayy1Hs53vgDx2wK4B+W5kOaHX8X8RJvuwyfoXhXmUiu2+kXms6c7svSzco8a5LBzcCRb
7w967V6by7rSRAihxt2VvFs3d4/P2psMGkhiE7S1Vnd17xpHmYT14glbPShgKRJd+EsSc6jE/tJv
Ob4KiklWTNUBqMRQn5C0ndegYQ3nVVyGAcL6zrow+EfJFXsX2RAzinhCc2Qg9VzPuNGEUTmHNa0g
e2+nP6pyC+4dT9pY9hixLsF15axpBnNxmF52bsXrwWheDUXLSe6798C+aGdITIovZ85KhozNuy6p
6do=
=eOYX
-----END PGP SIGNATURE-----

--------------JHzcu8CSsphSJ0ItM1dzZ09h--

--===============3483600317042141790==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users

--===============3483600317042141790==--