Re: Apache->CGI script, NOPASSWD is set, but sudo requires auth

On Mon, 09 Mar 2026 13:03:24 +0300, Evgeniy Berdnikov wrote:

>  Sudo debug logs shows sequence of called functions, but they have almost
>  nothing about logic, namely performed tests and their results.

The sudoers debug log should also contain information about how the
user or command was (or was not) matched.

You should see lines like:

    user www-data matches sudoers user www-data: ALLOW @ userpw_matches()

And for the command matching:

    user command "/bin/id" matches sudoers command "/bin/id": ALLOW @ command_matches()

A line like this in /etc/sudo.conf will only log the match-related
data:

    Debug sudoers.so /var/log/sudoers_debug match@debug,nss@debug

Debian, list most (all?) Linux distros, has made /bin a link to
/usr/bin so you might try updating your sudoers rules and CGI script
to match.  This should not matter, sudo ought to just follow the
link, but is worth trying.

>  PS. A after installation of updates my "working" host become broken, and
>  now sudo sends me e-mails with text "www-data : user NOT in sudoers".

That sounds like a different issue.  Is your cgi script executing
in a chroot jail by any chance?

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users