[Solved] Sudoers.d file for `service`

Installing and Using OpenWrt
1

Hello:

When I need to check the status of a service in a Linux box, I use this command as root:

:~# service rsyncd status
running
:~#

If I want to do this as a user instead of doing it as root, I'd generate a specific sudoers file to add to /etc/sudoers.d.

Like this one I use to run dmesg in my Linux boxes:

:~$ sudo cat /etc/sudoers.d/user_dmesg
groucho ALL = NOPASSWD:/bin/dmesg 
:~$

This because I am convinced that the use of sudo, like a few other things in life, needs to be under check.

I'm at odds with it and can't find a way to get a users_service file that works.
I cannot find the path to service like I can do with any other Linux installation I use.
eg:

[root@devuan ~]# which service
/usr/sbin/service
[root@devuan ~]#

But not in my OpenWRT NAS:

root@OpenWrt:~# which service
root@OpenWrt:~# 

root@OpenWrt:~# /usr/bin/service
-ash: /usr/bin/service: not found
root@OpenWrt:~#

I'd appreciate some help with that.
Thanks in advance,

PCL

2

It's defined as a shell alias.

3

Hello:

I see.
But it is not (?) listed as one:

root@OpenWrt:~# alias
grep='grep --color=always'
diff='diff --color=always'
la='ls $LS_OPTIONS -all -h'
ip='ip -color=always'
ll='ls -alF --color=auto'
more='less'
vim='vi'
root@OpenWrt:~#

The thing is that visudo will not validate a stanza without a path.
ie: service rsyncd status

Thank you for your input.

Best,

PCL

4
  1. it is defined in /etc/shinit as a function. it is not an alias.
  2. openwrt is not a full distro, it is crafted to perform as network router hence many "usual" tool is not or in different or with reduced functionality available. it is a big plus that being a router it can perform other things too.
  3. owrt by default is a single user system which is root user. so there is no need for sudo. (there are other technical users to run various services but as shell user default is root).
1 Like
5

Hello:

I see.

Yes, I am quite aware of that.

Indeed.
The My Book Live appliances would be nothing but a useless paperweight without OpenWRT. Once again, many thanks for that. 8^D

Yes, when used as a router.

But in the case of the My Book Live appliances I'd rather stay away from root save for very specific things. eg: solving bad shudown issues.

In fact, I have set up a few files in sudoers.d for specific tasks which require root.
They will be used extensively till I manage to set up my backup routines, a task which is requiring a lot of trial and error.

Once all that gets done/ironed out, they will be necessary once every so often.

Thank you very much for your input.

Best,

PCL

6

You may still be missing the key point, openwrt has none of the underlying services and components to run as a multiuser system.

There are very hacky ways to add other users, such as direct editing passwd files, but that’s not really the same as changing the os to be multiuser.

You will be making some pretty fundamental changes to add the user management plumbing and all the supporting security. If you’re up for that, cool! But be mindful that those types of changes won’t be accepted back into openwrt.

You may actually be better served by running a full Linux install on your NAS, most that have mainline kernel support can run Debian reasonably easily.

1 Like
7

Hello:

No.
The key point is quite clear to me.

Particularly if by multiuser you mean more than one even though it is just one.
ie: one being the only user with very limited and specific root privileges.

Not a chance. 8^D

I have no interest in anything but adapting it to my needs, the same way someone else adapted OpenWRT to run on abandoned My Book Live hardware and solved a severe problem for a lot of people and the environment.

Much less interest in requesting any changes to further my folly.

Sure ...
But the hardware on the My Book Live has two issues that prevent me from getting that done:

  1. it is very low end: APM82181@800 MHz/256 MB and 512K flash
  2. Unfortunately, Debian dropped support for PowerPC/ppc32 back at Debian 9.
    The only suitable/feasible option is OpenWRT.
    ie: actively maintained and updated, hopefully for a few years still.

BTW, I found a solution to the question with which I started this thread.

~$ sudo /etc/init.d/rsyncd status
running
~$

Added another line to /etc/profile.d/custom.sh :
alias daemon="sudo /etc/init.d/rsyncd status"

And that was it:

~$ daemon
running
~$

The daemon alias will be part of a script which will run anytime I ssh into the NAS and provide me at a glance with basic stats I want to know when I check on it.

Thanks you very much for your input.

Best,

PCL

8

Glad it works for you, I’m still intrigued by what you are doing though.

So you ssh into openwrt as root and then use sudo to execute commands, also as root?

What is sudo doing for you in that use case?

Or have you setup an additional user and cobbled together sudo support?

9

Hello:

Basically this:
I ssh to the NAS from my Linux Devuan box.
For the time being with a PW, eventually with a public key.
I can still ssh as root (just in case) but use the user I set up.
Eventually ssh as root will be dropped.

I don't want to use the UI, just the terminal.
Otherwise I'll never polish that aspect of Linux enough to feel comfortable with it.

Once I ssh in, besides seeing the the usual BusyBox v1.33.2 (2022-02-16 20:29:10 UTC) built-in shell (ash) banner, I want to see a quick status report:

uptime
rsyncd status
drive temperature
/sda1 and /sda3 use
dmesg | grep extract to see any e2sfck warnings

If everything is as expected, I log out.
If not, I proceed with whatever needs to be done.

Most times it will be fixing the result of a power hickup resulting in a bad shutdown.

See e2fsck warning in dmesg

No.

Yes, but not cobbled.
All necessary packages and instructions are on the OpenWRT site.
It was quite straightforward to set up a user and sudo with /etc/sudoers.d files.

I did not invent anything new. =^ )

Now I have to see about a script that will tie all that together in a neat six line report.

Thanks for your input.

Best,

PCL

10

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.