I need help with a sudo -A command in a shell script. The -A option is for AskPass. According to the sudo man page:
Normally, if sudo requires a password, it will read it from the user's
terminal. If the -A (askpass) option is specified, a (possibly
graphical) helper program is executed to read the user's password and
output the password to the standard output. If the SUDO_ASKPASS
environment variable is set, it specifies the path to the helper
program.
I'm interested in AskPass because I'm running apache2 (v 2.4.41) on a Ubuntu 16.04 server. The Apache webpage needs to execute a shell script. The webpage executes the script as user www-data. But the script needs to run another program that can only be run as user user1. So I need sudo --AskPass so that user www-data can run user user1's code.
My setup: Following such examples as here and here, I've written these two scripts in the /var/www/html/ directory:
user1@myUbuntu:/var/www/html$ ls -l
-rwxr-xr-x 1 www-data TestUsers 29 Feb 28 11:34 passwdScript.sh
-rwxrwxr-x 1 www-data TestUsers 2009 Feb 28 11:32 webpageScript.sh
user1@myUbuntu:/var/www/html$
(Group TestUsers includes users www-data and user1.) The little passwdScript.sh script is meant to send user1's password to STD OUT:
user1@myUbuntu:/var/www/html$
user1@myUbuntu:/var/www/html$ more passwdScript.sh
#!/bin/sh
echo 'myPassword'
user1@myUbuntu:/var/www/html$
user1@myUbuntu:/var/www/html$ ./passwdScript.sh
myPassword
user1@myUbuntu:/var/www/html$
(Yes, I know this is highly insecure, but I will be the only person using this server. I'm worried about functionality only.)
Okay: Now that the above is set up, here's my webpageScript.sh script, which is meant to call sudo --AskPass:
echo "Script is running."
export SUDO_ASKPASS="/var/www/html/passwdScript.sh"
echo "Test :: $SUDO_ASKPASS"
cd /home/user1/path/to/other/directory
pwd
sudo -u user1 --askpass $SUDO_ASKPASS 'runUser1Script.exe'
echo "Finished running the script."
Here's the less-than-impressive output:
user1@myUbuntu:/var/www/html$
user1@myUbuntu:/var/www/html$ sudo -u www-data ./webpageScript.sh
Script is running.
Test :: /var/www/html/passwdScript.sh
/home/user1/path/to/other/directory
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts
Finished running the script.
user1@myUbuntu:/var/www/html$
user1@myUbuntu:/var/www/html$
So obviously the sudo --askpass command is failing to accept user1's password. I've been trying variations on that command all day. Does anyone see what I'm doing wrong?
