How to switch to different user inside a shell script and execute some command with the new user?

Question

I am currently logged into "SERVER1" with user "USER1", and i have placed my bash script here. This script has to switch to different user "USER2" on the same server "SERVER1" and execute some commands with the new switched user.

Note: USER1 is not a root user, so i need to specify the USER2 password inside the script, but in a encrypted format.

Please help me in achieving this..!

#!/bin/bash

command1
command2
.
.
...

echo "PASSWORD" | su USER2 << EOF
command1
command2
.
.
...

Please note, i don't want to change any configuration files here to achieve this.

Even if you manage to use su and pass the password using expect, the password needs to be plain text. Use sudo with NOPASSWD option. This will guarantee no one can steal the password from your script. — alvits
– alvits, Commented Nov 18, 2016 at 2:45

paddy · Accepted Answer · 2016-11-18 02:51:26Z

6

It's not a good idea to store passwords in scripts, or attempt to stream them into su. The better approach is to use sudo.

Since you're allowing USER1 to act as USER2 without a password, you can set up /etc/sudoers like this:

USER1 localhost=(USER2) NOPASSWD: ALL

Then you can invoke sudo as USER1 as follows:

sudo -u USER2 bash

If you want to lock it down a bit more, you can specify a script that the user is allowed to execute. The line in /etc/sudoers might look like:

USER1 localhost=(USER2) NOPASSWD: /home/USER1/setup.sh

And you would call:

sudo -u USER2 /home/USER1/setup.sh

Note in this last example, I think that USER2 would need to have an actual shell configured in /etc/passwd (i.e. NOT /bin/false).

answered Nov 18, 2016 at 2:51

paddy

63.7k7 gold badges68 silver badges109 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Rohith Over a year ago

ya.. i know this. I was just trying to get it done without touching /etc/sudoers file, as i am not a root user to edit it. Thanks for the reply..!

Jonathan Leffler Over a year ago

@Rohith: If there are painful limitations like "I can't add anything to /etc/sudoers", then you should list them in the question so that people can avoid giving you the obvious sensible answer when it doesn't meet your requirements because of the limitations. (There's also a difference between "don't want to" and "do not have permission to" w.r.t "edit configuration files".) If you can't hack /etc/sudoers, you may need to explore expect in combination with su or something similarly devious. That's not a good solution; it might be a better solution, though.

paddy Over a year ago

If you don't have root privileges on that system, then what business do you have executing commands as another user?

Rohith Over a year ago

@JonathanLeffler: Sure will try that.

Rohith Over a year ago

@paddy: I am from Automation Team, i don't have root privileges on the PROD servers, SysAdmins do. They might not agree to edit /etc/sudoers, will check with them. Thanks..!

|

Collectives™ on Stack Overflow

How to switch to different user inside a shell script and execute some command with the new user?

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related