Help:Sudo Policies

From Wikitech
Jump to navigation Jump to search


sudo is a program for Unix-like computer operating systems that allows users to run programs with the security privileges of another user, by default the superuser.

This page describes policies for using sudo on Cloud VPS.

Add yourself as a sudoer

When you attempt to run a sudo command, e.g. sudo su, you may get the response username is not allowed to run sudo on instance-name. This incident will be reported. If you don't require restricting access on the project, and you're a projectadmin, then you can add yourself as a sudoer via

  1. Click on Access > Project Sudo for a given project
  2. Click on Add Rule OR Modify Rule to change an existing sudoers rule set
    • Rule Name - enter whatever you’d like, e.g., “default”
    • Commands - enter ALL into the textfield or add more complex sudoers rules
    • Options - leave it blank
    • Users - check specific user(s) or the special [Any project member] value

Changes take effect immediately.

After logging in to your instance, test sudo by typing sudo echo 'it works'. If "it works" is echoed back to you, then you will retain sudo access for the remainder of your session.

Note that passwordless sudo access is now enabled. If you are prompted for a password do not enter your Developer account/Wikitech password. The password prompt is a sign that the instance you are using is having difficulty communicating with the LDAP directory server.

Workaround for sudo -u

Some installation guides (notably for the OSM tile server) ask you to run "sudo -u someuser" commands.

These commands will fail on EQIAD instances with "Sorry, user X is not allowed to execute 'Y' as someuser on"

The workaround is to first run: sudo su && su someuser && bash

Then run the next command normally.

An alternate solution is to run the sudo under sudo!

$ sudo -u www-data whoami
[sudo] password for bd808: ^C
$ sudo -- sudo -u www-data whoami

Why does this work? The first sudo changes your effective user id to 0 (root). Then the second sudo is executed which changes the effective user id again and then executes the desired command.

Communication and support

We communicate and provide support through several primary channels. Please reach out with questions and to join the conversation.

Communicate with us
Way Connect Best for
Phabricator Workboard #Cloud-Services Task tracking and bug reporting
IRC Channel #wikimedia-cloud connect
Telegram bridge
mattermost bridge
General discussion and support
Mailing List cloud@ Information about ongoing initiatives, general discussion and support
Announcement emails cloud-announce@ Information about critical changes (all messages mirrored to cloud@)
News wiki page News Information about major near-term plans
Cloud Services Blog Clouds & Unicorns Learning more details about some of our work
Wikimedia Technical Blog News and stories from the Wikimedia technical movement