2

I have this weird setup that once I log onto our server with the sudo uat command, I will be logged in with my own user dadinn@uat. I have set up .ssh/config so that uat is really an alias for hostname uat.foobar.com.

To access some log files, I would first have to switch to user app01@uat. Then once switched user, I would like to open file ~/logs/myapp/20221108.log.

Under normal circumstances I would expect opening path /ssh:uat|sudo:app01@:logs/myapp/20221108.log with TRAMP would do the trick.

Unfortunately, because of our weird system setup, I can only access this file in the terminal with the following commands:

dadinn@dev:~$ ssh uat
dadinn@uat password: ********
dadinn@uat:$ sudo su - app01
[sudo] password for dadinn: ********
app01@uat:~$ cat logs/myapp/20221108.log

An irrelevant detail is that for SSH login I have to use a password instead of public key. Nevertheless, I don't think that affects this issue.

Also, I have to note that once I've ssh-d into the uat host, I MUST use the command sudo su - app01 to switch user.

Typing sudo su app01 throws an error:

Sorry, user dadinn is not allowed to execute '/sr/bin/su app01' as root on uat.foobar.com

Also, typing sudo -i -u app01 throws an error:

Sorry, user dadinn is not allowed to execute '/bin/bash' as app01 on uat.foobar.com

Following suggestions in the comments, the output of sudo -l shows that indeed there are explicit limitations on what commands my user can execute with sudo:

User dadinn may run the following commands on uat: 
  (root) /bin/su - app01, /bin/su - app02

I have tried connecting with TRAMP using /ssh:uat|sudo:|su:app01@: and pressed TAB, which did start to ask for sudo password, but then failed with this error in the mini-buffer:

[Tramp: Opening connection for app01@uat using su...failed]

I assume this might be because TRAMP doesn't pass the --login option to the su command?

Any suggestions how to work around this?

4
  • What does sudo -u app01 do? sudo su - app01 uses sudo to become root, then runs su to become another user, which is a commonly–seen anti–pattern. I suppose it is possible that your system administrator has deliberately configured sudo so that you are only allowed to use it to run su, but that seems unlikely. Incidentally, sudo -i app01 is an error because it is trying to login as root and run the command app01. sudo -i -u app01 should do what you want though. I suppose you could also include the output to sudo -l in your question as an aide to debugging.
    – db48x
    Nov 19, 2022 at 11:08
  • sudo -u app01 does nothing, except it seems to print out lines from the usage help (only the lines starting with usage: ). I also think it seems quite the case that the administrators indeed deliberately configured sudo to only allow executing su. I can see my mistake with the sudo -i app01 command. sudo -i -u app01 on the other hand throws error Sorry, user dadinn is not allowed to execute '/bin/bash' as app01 on uat.foobar.com. Nov 19, 2022 at 12:34
  • 1
    Thanks for suggesting trying sudo -l, it indeed explains the situation: User dadinn may run the following commands on uat: (root) /bin/su - app01, /bin/su - app02. So the admins deliberately limited what commands can be executed. Nov 19, 2022 at 12:36
  • Wow, that is weird. Well, if using both the sudo and su tramp methods doesn’t work, then there’s nothing for it but to add a new method to tramp-methods as suggested.
    – db48x
    Nov 19, 2022 at 12:48

1 Answer 1

4

The variable tramp-methods keeps the arguments which Tramp uses for different methods. For sudo, there is the entry

`("sudo"
  (tramp-login-program        "env")
  (tramp-login-args           (("SUDO_PROMPT=P\"\"a\"\"s\"\"s\"\"w\"\"o\"\"r\"\"d\"\":")
                               ("sudo") ("-u" "%u") ("-s") ("-H") ("%l")))
  (tramp-remote-shell         ,tramp-default-remote-shell)
  (tramp-remote-shell-login   ("-l"))
  (tramp-remote-shell-args    ("-c"))
  (tramp-connection-timeout   10)
  (tramp-session-timeout      300)
  (tramp-password-previous-hop t))

See tramp-sh.el for details. I recommend you add an own method, let's call it mysudo, with the same specification as above, but with changed tramp-login-args.

2
  • This looks quite promising. Looking at the "su" method (tramp-login-args (("-") ("%u"))) option is already set. I don't understand why /ssh:uat|sudo:|su:app01@: does not work. I assume this would execute the sudo su - app01 command on the remote host. I also see that both "su" and "sudo" methods have a (tramp-remote-shell #1#) option... I can't find any documentation on what that #1# means. Nov 19, 2022 at 13:06
  • Sorry, just realised that /ssh:uat|sudo:|su:app01@: would not execute sudo su - app01, but possibly instead sudo bash -c su - app01, which is not a sudo command the policy would allow. Nov 20, 2022 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.