Linux: Allow User to Skip Sudo Challenge

When scripting command line work, you will come across the need to respond to sudo challenges, to execute commands that require elevation, if not running as root.

You can choose to pass the user's password as stdinput, using the command line gymnastics at the bottom of this: C# Dealing with Sudo

Or, you can allow a specific user, members of a group, or all users (if you really hate sudo), to skip sudo challenges, by adding them to the sudoers group, with a NOPASSWD flag.

If you are looking to remove complexity from your automated scripting, or just really annoyed with having to type your password everytime you use a privileged command, this page will show you how to bypass sudo checks.

You can bypass sudo checks for a single user, a group, or for all.

You can specify what apps can be called without sudo.
Or, make it wide-open.

The intended use case for this page is how to setup a user account that will be used by automated scripting for provisioning and deployment.

NOTE: Changes to visudo are immediate, since the file is read each time sudo is called.
So. You don't have to logout, restart a service, or reboot for changes to take effect.

How To

Open the sudoers file with this:

sudo visudo -f /etc/sudoers

Now, you can add your entries, above the @includedir line.

For a Single User

NOTE: This level of sudo bypass is a reasonable choice for automated scripting.

If you want to grant passwordless sudo for a single user, add a line, like this:

username ALL=(ALL) NOPASSWD: ALL

• username: the actual username

• ALL: means from any host (relevant in multi-user systems)

• (ALL): means the user can run commands as any user

• NOPASSWD: ALL: no password will be required for any sudo command

For Members of a Group

If you want to grant passwordless sudo for a single user, add a line, like this:

%groupname ALL=(ALL) NOPASSWD: ALL

• groupname: the name of the group

• ALL: means from any host (relevant in multi-user systems)

• (ALL): means the user can run commands as any user

• NOPASSWD: ALL: no password will be required for any sudo command

Limit App Usage

When declaring a sudo bypass entry, you can constrain what apps or commands can be called without sudo, like this:

deploy ALL=(ALL) NOPASSWD: /usr/bin/apt-get, /bin/systemctl restart *, /usr/bin/useradd