Run a shell script as another user that has no password

Question

I would like to run a script from the main ubuntu shell as a different user that has no password.

I have full sudo privileges, so I tried this:

sudo su -c "Your command right here" -s /bin/sh otheruser

Then I have to enter my password, but I am not sure if that script is now really running under that user.

How can I confirm that the script is really running under that user now?

score 543 · Accepted Answer · edited Dec 27 '22 at 10:23

543

You can do that with su or sudo, no need for both.

sudo -H -u otheruser bash -c 'echo "I am $USER, with uid $UID"'

The relevant parts of man sudo:

-H   The -H (HOME) option requests that the security policy set
     the HOME environment variable to the home directory of the
     target user (root by default) as specified by the password
     database.  Depending on the policy, this may be the default
     behavior.

(Starting from Ubuntu 19.10, -H is no longer needed as this is now the default behaviour. See: How does sudo handle $HOME differently since 19.10?)

-u user     The -u (user) option causes sudo to run the specified
      command as a user other than root.  To specify a uid
      instead of a user name, use #uid.  When running commands as
      a uid, many shells require that the '#' be escaped with a
      backslash ('\').  Security policies may restrict uids to
      those listed in the password database.  The sudoers policy
      allows uids that are not in the password database as long
      as the targetpw option is not set.  Other security policies
      may not support this.

~~su can only switch user without providing a password if you are root. See Caleb's answer~~

You can modify the /etc/pam.d/su file to allow su without password. See this answer.

If you modified your auth file to the following, any user that was part of group somegroup could su to otheruser without a password.

auth       sufficient pam_rootok.so
auth       [success=ignore default=1] pam_succeed_if.so user = otheruser
auth       sufficient   pam_succeed_if.so use_uid user ingroup somegroup

Then test from terminal

rubo77@local$ su otheruser -c 'echo "hello from $USER"'
hello from otheruser

edited Dec 27 '22 at 10:23

muru

197,895
55
485
740

answered May 13 '13 at 11:20

geirha

46,101

7

Can you please add how to do it with just su too? – rubo77 Oct 06 '14 at 12:33
2

This asks me for a password :-( – IanVaughan Jul 20 '15 at 12:39
2

@IanVaughan, With default configuration (of sudo), you will get asked for a password unless you run it as root. You can configure sudo to "allow user A to run cmd C as user B without requiring a password". See https://help.ubuntu.com/community/Sudoers – geirha Jul 21 '15 at 12:54
1

I'm prompted for a password when running this as root. Any suggestions? – Nate Nov 28 '15 at 00:26
@Nate, have you made some changes to the sudoers file. The default configuration allows root to run anything as anyone, without requiring a password. – geirha Nov 28 '15 at 09:37
WIll this change the HOME variable just for the command I run? (meaning that the next ones will be run as before) – Victor Feb 28 '16 at 17:34
Does this work for GUI applications? – William Apr 05 '17 at 01:53
@Victor Yes, you can try sudo -H -u user bash -c 'echo ~' – xi.lin Aug 01 '17 at 02:24
This trigger password prompt for me too - even when I already config it not to with myuser ALL=NOPASSWD: ALL in sudo visudo – Nam G VU Mar 27 '19 at 10:03
1

@NamGVU keep in mind that order matters. If your sudoers has a rule further down that sets other permissions for your user, or a group you're a member of, that will override your NOPASSWD rule. – geirha Mar 28 '19 at 07:12
@geirha Thank u for the warning. My visudo content is very short and only a few line definin the NOPASSWD as above. – Nam G VU Mar 28 '19 at 07:48
@geirha sudo -H not working on centos – ImranRazaKhan Apr 02 '20 at 14:27
@ImranRazaKhan how do you tell it isn't working? – geirha Apr 03 '20 at 07:10

score 169 · Answer 2 · edited Apr 07 '15 at 00:03

169

If you want to use su instead of sudo, I believe you can use something like this:

su - <username> -c "<commands>"

- will simulate a login of the specified user
-c tells it that you want to run a command

ps. Unfortunately I'm not able to install ruby using rvm with this method, but that's probably not related.

edited Apr 07 '15 at 00:03

muru

197,895
55
485
740

answered Apr 07 '15 at 00:01

Caleb

1,791

8

I needed to add sudo to the beginning otherwise it asked me for my password. – IanVaughan Jul 20 '15 at 12:42
2

This definitely doesn't work without sudo. with sudo it works, for example: sudo su - www-data -c "touch /tmp/test"successfully created a file as www-data – rubo77 Sep 24 '16 at 08:41
1

To use "su" you need the root password, the point of "sudo" is to avoid that. If you have the root password using "su" as above should work fine. – Samuel Åslund Jun 30 '17 at 07:51
"unfortunately I'm not able to install ruby using rvm with this method": when I used this command, the resulting path was bare (e.g., /bin:/usr/bin), so my command (similar to your rvm) wasn't found. – PLG Nov 11 '20 at 18:25
and what about switching to a specific group? – woodz Jan 17 '21 at 12:27
No simulation involved. Using su, you are performing a login. su literally stands for "switch user". sudo lets you mask yourself as the root user, whereas su lets you log in as that user (or any user so long as you have the appropriate passwod.) Using sudo su is like saying "Hey, this is the root account . Could you switch me to the root account?" That said, it still has it's place. – Nate T Oct 08 '21 at 17:35

score 12 · Answer 3 · answered May 11 '17 at 18:30

12

The answers above are really useful to me but to answer the actual question...

How can I affirm that the script is really running under that user now?-

Use:

ps -ef | grep <command-name>

The output should include your script and the actual user executing it. People on BSD-like systems, e.g. MAC can find similar information with:

ps aux | grep <command-name>

answered May 11 '17 at 18:30

Samuel Åslund

239

Linux users can use ps aux. – Dean Howell Sep 20 '18 at 20:08
1

@DeanHowell; True, but MAC users can not use "ps -ef" and the "ps aux" is BSD options, only available as a compatibility feature while the "ps -ef" is standardized Unix/POSIX options. – Samuel Åslund Sep 22 '18 at 10:26

Reshad Zazai · Answer 4 · 2020-07-09T18:59:36.130

11

Make sure you switch to root user with command sudo su and then use the command

su user -s <command>

For example: su www-data -s bin/magento cache:clean

edited Jul 09 '20 at 18:59

answered Jun 18 '20 at 09:34

Reshad Zazai

111
1
5

This is the only solution that worked for me! Thanks! – Mohammed Noureldin Oct 17 '21 at 22:02
For me, it was easier: sudo su - <user> as in sudo su - <user> -s <command> – trebor Jul 11 '23 at 18:52

score 3 · Answer 5 · edited Oct 15 '21 at 13:26

3

sudo -u <user> <command>

edited Oct 15 '21 at 13:26

BeastOfCaerbannog

14,585

answered Oct 08 '21 at 19:46

Gurseerit

45

score 3 · Answer 6 · edited May 06 '17 at 11:26

3

I had the same problem. Just type in the command screen -dmS testscreen this will create a detached screen on your non-sudo user account and then you can log it and check if this screen is there by screen -ls.

edited May 06 '17 at 11:26

d a i s y

5,511

answered May 06 '17 at 08:35

liime

31

score 2 · Answer 7 · answered Apr 10 '22 at 18:01

2

root@localhost:/# su - johndoh -c "whoami"
johndoh
root@localhost:/# su - johndoh -c "echo \"hi $(whoami)\""
hi root
root@localhost:/# su - johndoh -c "echo \"hi \$(whoami)\""
hi johndoh
root@localhost:/#

answered Apr 10 '22 at 18:01

Peter Kionga-Kamau

141

score 1 · Answer 8 · answered Nov 11 '20 at 14:43

You can use sudo to do this. First, you need to modify the /etc/sudoers file to add a rule that allows the hudson user to become the other user for the script in question. Let's assume you have a user1 account that needs to run /usr/local/bin/my_script.sh.

Run visudo to modify the sudoers file. Then, use the following sudo command to run the script from hudson.

It's very important that you use visudo to modify the sudoers file in order to check the file for errors before putting it in place. Also, I'd suggest a quick read through man sudoers in order to clearly understand what the above does before adding it to your configuration.

You should show the actual line(s) that would be inserted into sudoers file. — WinEunuuchs2Unix, Nov 11 '20 at 18:51

score 1 · Answer 9 · answered Jan 30 '22 at 14:32

I have created few users without password using

sudo adduser --gecos "" --disabled-password --no-create-home user1
sudo adduser --gecos "" --disabled-password --no-create-home user2

To confirm please check

% sudo cat /etc/shadow | grep user
user1:*:19022:0:99999:7:::
user2:*:19022:0:99999:7:::

I have written a shell script named testing.sh like:

#!/bin/bash
whoami
id

Now I am going to run this script as different users who do not have any password.

$ sudo runuser -u user1 -- bash testing.sh
user1
uid=1001(user1) gid=1001(user1) groups=1001(user1)
$ sudo runuser -u user2 -- bash testing.sh
user2
uid=1002(user2) gid=1002(user2) groups=1002(user2)

Can you elaborate runuser and the double hyphen --? – rubo77 Jan 31 '22 at 00:00 — rubo77, Jan 31 '22 at 00:00

score 0 · Answer 10 · answered Oct 08 '21 at 17:19

I use "ssh" pointing to the same local machine. This enables me to run the shell script or command passwordless.

ssh target-user@localhost script-to-execute

First, I make sure the host-user saved his public key to the target user (in the same machine). Then I execute the ssh command I showed above.

The result, is a command/script run as the target user, without even entering a password.

Run a shell script as another user that has no password

10 Answers10

Linked

Related