in reply to Automating sudo actions

Another approach would be to make an ssh connection to root@localhost using an ssh key that is authorised for the purpose, and limited to only do the required things.

In the /root/.ssh/authorised_keys file, you can put a lot of fancy configuration against they key to only allow certain commands to be run, and only accept connections from certain machines.

On the command issuing side, the ssh key need not have a pass phrase, because what it can be used for as root will be very strictly limited. It will be impossible to use it to get a shell for example.

Replies are listed 'Best First'.
Re^2: Automating sudo actions
by MidLifeXis (Monsignor) on Jan 25, 2011 at 14:11 UTC

    I would add a caveat (absolutes in security, and other areas of life, are asking to be shown the exception).

    It will be impossible to use it to get a shell for example.

    If properly written to avoid exploitation, it will be impossible to use it to get a shell for example.

    --MidLifeXis

[reply]
      Thanks for all the great suggestions. Unfortunately, changing the environment is quite impossible. I'm stuck having to 'sudo bash'. If I can't automate through that (icky) interface, I'm stuck largely copy/pasting chunks of commands.

      Can this be done in perl?

[reply]
        Thanks for all the great suggestions. Unfortunately, changing the environment is quite impossible. I'm stuck having to 'sudo bash'. If I can't automate through that (icky) interface, I'm stuck largely copy/pasting chunks of commands.

        Why are you stuck to 'sudo bash'? Why can't you do `sudo perl_script`?

        Well, even if you can't control sudo configuration and only "bash" is available for execution, then try something like 

        my $pid = open(OUT, "|-");
die "Can't fork\n" unless defined $pid;
if(!$pid)
{
    exec "sudo bash";
    die "oops no exec\n";
}

select OUT;
$| = 1;
print "echo hi there\nexit\n";
close(OUT);

        [download]
        Read perldoc perlipc. Section Bidirectional Communication with Another Process. Maybe this will help you to do simple automation.

[reply]
[d/l]

In Section Seekers of Perl Wisdom