Apache->CGI script, NOPASSWD is set, but sudo requires auth

 Hi.

 I have 2 hosts on Debian (amd64), running sudo 1.9.17p2 with the same
 configuration. Both have Apache running CGI scripts with same uid/gid.
 I have to execute some programs as root, and use sudo for this task.
 The problem is: on one host sudo runs fine, on other is fails with:

sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: a password is required

 My test environment is described below.

 /etc/sudoers.d/www-data:
	www-data ALL = NOPASSWD: /bin/echo
	www-data ALL = NOPASSWD: /bin/id

 Test CGI script:
-----------------------------------------------------------------------
#!/bin/sh

echo "Content-Type: text/plain; charset=UTF-8"
echo ""

date +"[%T]"
tty
id
echo ""
echo PATH=$PATH
echo ""

echo "command: sudo -l -U www-data"
sudo -l -U www-data
echo ret=$?
echo ""

for cmd in "/bin/echo test1" /bin/id ; do
	echo ""
	echo "command: $cmd"
	/usr/bin/sudo $cmd
	echo ret=$?
done
-----------------------------------------------------------------------

 On first host output is as expected:
-----------------------------------------------------------------------
23:14:35]
not a tty
uid=33(www-data) gid=33(www-data) groups=33(www-data)

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin

command: sudo -l -U www-data
Matching Defaults entries for www-data on berd-3:
    env_reset,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User www-data may run the following commands on berd-3:
    (root) NOPASSWD: /bin/echo
    (root) NOPASSWD: /bin/id
ret=0


command: /bin/echo test1
test1
ret=0

command: /bin/id
uid=0(root) gid=0(root) groups=0(root)
ret=0
-----------------------------------------------------------------------

 On second host output is:
-----------------------------------------------------------------------
[23:15:42]
not a tty
uid=33(www-data) gid=33(www-data) groups=33(www-data)

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin

command: sudo -l -U www-data
ret=1


command: /bin/echo test1
ret=1

command: /bin/id
ret=1
-----------------------------------------------------------------------

 Apache on 2nd host writes message "a terminal is required to read
 the password..." (from sudo) to error log.
 
 I tried to run this CGI script from interactive shell with uid/gid=33/33,
 problem was not reproduced -- sudo works as it should. In this test
 sudo is called with tty (/dev/pts/n).

 I tried to do same test, but remove tty with nohup and "setsid < /dev/null",
 in both variants sudo works right, problem was not reproduced.

 The only know way to reproduce problem is run from Apache as CGI script.

 I tried to add "Defaults www-data !authenticate" to sudoers file,
 in addition to NOPASSWD options, it does not help (as expected).

 I tried to enable debug options in /etc/sudo.conf

   Debug sudo /var/log/sudo_debug all@debug
   Debug sudoers.so /var/log/sudoers_debug all@debug

 and run scripts under Apache. It results in large volume files with
 minor differences. On some place log from "good" host has "policy plugin
 returns 1 ()" message, on "bad" log has call to tgetpass function and
 then message "a terminal is required to read password". I attach vimdiff
 screenshot for sudo_debug as illustration.

 How this issue can be studied? Any ideas why it happens?

 PS. This configuration works several years on both hosts, with periodical
 Debian updates. So I'm sure problem is not in misconfiguration of sudo...
 Unfortunately, sudo debug logs do not shed light on conditions been checked
 and results of these checks.
-- 
 Eugene Berdnikov
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users