2

I have 2 linux servers. RHEL 5.11 and RHEL 7.3. And I have a bash script named "deploy.sh" at /app/deploy/deploy.sh and /app2/deploy/deploy.sh. There is a user group named "deployers" on Centrify and a user who member of this "deployers" group. This user (I'll call it as "deployer") can run deploy.sh script with dzdo on first server (5.11 Tikanga) but it cannot run the same script on second server (7.3 Maipo).

The following output is from Tikanga:

[deployer@tikanga ~]$ dzdo -u depuser /app/deploy/deploy.sh
Success!

[deployer@tikanga ~]$ ls -la /app/deploy/ | grep deploy
-rwxr-xr-x  1 depuser depuser     4960 Apr 14  2016 deploy.sh

[root@tikanga ~]# cat /etc/sudoers | grep deployers
%deployers ALL=(depuser)   NOPASSWD: /app/deploy/deploy.sh

And following output is from Maipo:

[deployer@maipo ~]$ dzdo -u depuser /app2/deploy/deploy.sh
Sorry, user deployer is not allowed to execute '/app2/deploy/deploy.sh' as depuser on maipo.

[deployer@maipo ~]$ ls -la /app2/deploy/ | grep deploy
-rwxr-xr-x.  1 depuser depuser  5159 Aug 17 12:22 deploy.sh

[root@maipo ~]# cat /etc/sudoers | grep deployers
%deployers    ALL=(depuser)   NOPASSWD: /app2/deploy/deploy.sh

Both of the servers in the domain with Centrify.

5
  • I'd suggest a chgrp deployers /app2/deploy/deploy.sh, however, your would lose the added security of requiring a su-like call before running the script. Commented Aug 23, 2017 at 9:03
  • It does not work. Same error again. Commented Aug 23, 2017 at 9:08
  • 2
    That dot at the end of the permissions on app2 might suggest SELinux has something to do with this
    – mcalex
    Commented Aug 23, 2017 at 9:29
  • I will try disable selinux when i get permit for rebooting the server. Thanks. Commented Aug 23, 2017 at 10:27
  • It was not about selinux. It was about Centrıfy user/group rules. Commented Aug 25, 2017 at 11:35

0

You must log in to answer this question.

Browse other questions tagged .