chef-soloをec2に向けてcookしたらsudoのスクリプトが動かせなかった

2014-06-11

tty経由でないと怒られるようになった(前はそんな事なかった気がする気がする)

原因はAmazonのLinuxのデフォの/etc/sudoersに下の一行があるから。

Defaults    requiretty

これをコメントアウトするようにchef-soloのレシピを追加して回避した。

もしかしたらwheel使うのが正しいのだろうか??

手順

recipeに追加したコード

directory '/etc/sudoers.d' do
    mode    '0755'
    owner   'root'
end

template "sudoers" do source 'sudoers.erb' mode '0440' owner 'root' end

/template/sudoers.erbを追加

## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
## 
## This file must be edited with the 'visudo' command.

## Host Aliases ## Groups of machines. You may prefer to use hostnames (perhaps using ## wildcards for entire domains) or IP addresses instead. # HostAlias FILESERVERS = fs1, fs2 # HostAlias MAILSERVERS = smtp, smtp2

## User Aliases ## These aren't often necessary, as you can use regular groups ## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname ## rather than USERALIAS # User_Alias ADMINS = jsmith, mikem

## Command Aliases ## These are groups of related commands...

## Networking # Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services # Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database # Cmnd_Alias LOCATE = /usr/bin/updatedb

## Storage # Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions # Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp

## Processes # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers # Cmnd_Alias DRIVERS = /sbin/modprobe

# Defaults specification

# # Disable "ssh hostname sudo <cmd>", because it will show the password in clear. # You have to run "ssh -t hostname sudo <cmd>". # # Defaults requiretty !!!!!!!!!HERE!!!!!!!!!

# # Refuse to run if unable to disable echo on the tty. This setting should also be # changed in order to be able to use sudo without a tty. See requiretty above. # Defaults !visiblepw

# # Preserving HOME has security implications since many programs # use it when searching for configuration files. Note that HOME # is already set when the the envreset option is enabled, so # this option is only effective for configurations where either # envreset is disabled or HOME is present in the envkeep list. # Defaults alwaysset_home

Defaults envreset Defaults envkeep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LSCOLORS" Defaults envkeep += "MAIL PS1 PS2 QTDIR USERNAME LANG LCADDRESS LCCTYPE" Defaults envkeep += "LCCOLLATE LCIDENTIFICATION LCMEASUREMENT LCMESSAGES" Defaults envkeep += "LCMONETARY LCNAME LCNUMERIC LCPAPER LCTELEPHONE" Defaults envkeep += "LCTIME LCALL LANGUAGE LINGUAS XKBCHARSET XAUTHORITY"

# # Adding HOME to envkeep may enable a user to run unrestricted # commands via sudo. # # Defaults envkeep += "HOME"

Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on ## which machines (the sudoers file can be shared between multiple ## systems). ## Syntax: ## ## user MACHINE=COMMANDS ## ## The COMMANDS section may have other options added to it. ## ## Allow root to run any commands anywhere root ALL=(ALL) ALL

## Allows members of the 'sys' group to run networking, software, ## service management apps and more. # %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands # %wheel ALL=(ALL) ALL

## Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL

## Allows members of the users group to mount and unmount the ## cdrom as root # %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system # %users localhost=/sbin/shutdown -h now

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment) #includedir /etc/sudoers.d

参考;
http://d.hatena.ne.jp/shibainu55/20090720/1248053978

#Linux  #EC2  #chef  #chef-solo