last day (15 days later) » 

13:54
0
Q: How can I run su root and enter credentials in a script?

O RICKETTSthere's a script that I have and it needs to be run by root user. I just wanted to know how to run that script using su in the script. - I'm running CentOS7. The command I attempted (below) failed: su root credentials=/home/root/root.cred and then continue with the rest of the script - sadly i...

You have a shell script and you want to change the shell to run as root in the middle of the script? Or you just want to run a script or program as root? What's credentials=... supposed to do, where did you get that?
Do you have sudo installed?
@terdon Do you mean can I use the sudo command? - yes, but only root can execute sudo commands and I would like it to stay that way, so want a standard user to run a sudo command - therefore I am using the command su root or just su to run the script as root but the command I attempted doesn't work.... any ideas?
You might not understand sudo's purpose. It is specifically for use cases like this, when one wants to allow a non-privileged user to run one specific privileged command, without having to enter credentials via an interactive method like keyboard password entry. Read the man page with man sudoers.
@JimL. But the user I want to run it is not a sudoer
13:54
visudo is the command to fix that.
@JimL. I think you've misunderstood. I know how to make this user a sudoer, but I want to run a script as a non sudoer but the script contains a sudo command. This is where the su command comes in. What I want to know is how to run this command in a script and supply credentials and run the rest of the script as root?
@terdon Can you help further?
I think you’re confused about the point of “su” and “sudo”. There is no credentials file you can use to give it a password. The “sudo” command can run, if configured properly, as a regular user.
@jsbillings Okay - thanks, so how can I run a sudo command as a regular user who is not a sudoer? - Is there a file that you can edit to change certain commands?
@JimL. I don't want the user to become a sudoer.
@ORICKETTS One very dangerous way is to use the sudoers file to allow executing your script without the need of the root password.
@ParsaMousavi That would be great! I know it sounds dangerous but only 2 people use this computer and if I can change the sudoers file to change it to run JUST THAT SCRIPT without the root password - amazing. Do you know how?
13:54
@ParsaMousavi Why would that be dangerous? That is safe unless the script is stupid or (rather seldom) the script operation is dangerous in itself.
@HaukeLaging I said it's dangerous just because of that. If the script is vulnerable ( to buffer overflow for example ) any user might gain further access to run all programs as root . And also the script file itself has to be immutable for non-root users , because a user can edit the file and run whatever he wants with root privileges. These are just a few of the possible dangers. For complicated scripts and programs , it's difficult to discover all vulnerabilities.
@ORICKETTS Please take a look at the link that I posted . And don't forget to change the mode of your script file to 500 ( via chmod 500 script.sh ) . By doing that , you're making the script file readonly for non-root users. Only root user can edit that file. If you don't do that , other non-privileged users might edit the file and run whatever they want as the root user without any password.
@ParsaMousavi Will do thanks
@ilkkachu Please see my updated question above, I have added some context below my original question. Also, please could you click the 'FOLLOW' button on this answer to keep updated so I don't have to notify you with @
@terdon Please see my updated question above, I have added some context below my original question. Also, please could you click the 'FOLLOW' button on this answer to keep updated so I don't have to notify you with @
bxm
bxm
At this point I think it’s going to be helpful if you post the script you are trying to run. Lots of words describing the thing in question are not a good substitute for seeing the actual thing. If it contains potentially sensitive information (real names, usernames, passwords, IP addresses, hostnames and such like), by all means replace such with placeholder text.
@bxm Done - I've updated it. Thanks
@ORICKETTS please stop pinging specific users and asking them to answer you. If someone can answer and wants to, they will. If I wanted to follow your question, I would have done so.

last day (15 days later) »