This is my sudoers configuration file
Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" # Host alias specification Host_Alias TX=12x.xxx.xxx.xx9 # User alias specification # Cmnd alias specification # User privilege specification root ALL=(ALL:ALL) ALL www_remote TX=(root) NOPASSWD:/bin/chown # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL # See sudoers(5) for more information on "#include" directives: #includedir /etc/sudoers.d
You still need to enter the password when executing sudo chown after logging in to www_remote remotely
[root@VM_xx_xx_centos ~]# sudo -u apache ssh xxx.xxx -l www_remote Linux iZ...Z 3.2.0-4-amd64 #1 SMP Debian 3.2.86-1 x86_64 Welcome to aliyun Elastic Compute Service! Last login: Sun May 14 17:55:32 2017 from 12x.xxx.xxx.xx9 www_remote@iZ...Z:~$ ls -l 总用量 0 -rw-r--r-- 1 www-data www_remote 0 5月 14 16:38 test www_remote@iZ...Z:~$ sudo chown :www-data test [sudo] password for www_remote: www_remote 无权在 iZ281fkjotsZ 上运行 sudo。此事将被报告。
If it is www_remote ALL=(root) NOPASSWD:/bin/chown, the command can be executed normally.
What is wrong with my configuration?
Move the "www_remote" line to the end of the file, otherwise %sudo will overwrite it.