Can I Prevent Fabric From Prompting Me For A Sudo Password?

I am using Fabric to run commands on a remote server. The user with which I connect on that server has some sudo privileges, and does not require a password to use these privileges

Solution 1:

Try passing shell=False to sudo. That way /bin/bash won't be added to the sudo command. sudo('some_command', shell=False)

From line 503 of fabric/operations.py:

if (not env.use_shell) or (not shell):
    real_command = "%s %s" % (sudo_prefix, _shell_escape(command))

the else block looks like this:

# V-- here's where /bin/bash is added
real_command = '%s %s "%s"' % (sudo_prefix, env.shell,
    _shell_escape(cwd + command))

Solution 2:

This is the most direct answer to your question: You do not actually have a problem; you misunderstand how Fabric run() and sudo() work.

Your "workaround" is NOT a workaround it is the 100% valid answer to the problem.

Here's a simple set of rules: 1) Use "run()" when you don't expect a prompt. 2) use "sudo()" when you do expect a prompt. (this should be true for all or most commands requiring a prompt, even if the executable in question is not Bash or Sudo).

This same answer applies to folks trying to run commands under "sudo". Even if sudoers has passwordless config for the current user on some system, if you use sudo() instead of run() then you will force a prompt (unless the Fabric code already contains an ENV password or key).

BTW the author of Fabric answered my question - very similar to your question - in #IRC. Nice guy, one of the unsung heroes of open source for persisting in his Fabric and Paramiko work.

...In my test environment, there is always 1 username which has full password-less access to sudo. Typing sudo echo hello will not prompt me. Furthermore, that sudo user is configured with "!requiretty" so all commands can run over SSH (like SSH hopping between hosts). This means I can simply use "run()" with to execute "sudo something", but it's just another command which runs without a prompt. As far as security is concerned, it is someone's job to lock down a production host but not a test host. (If you are being forced to test things by and and can not automate, that is a huge problem).

Solution 3:

You can use:

from fabric.api import env
# [...]
env.password = 'yourpassword'

Solution 4:

In your /etc/sudoers file add

userALL=NOPASSWD: some_command

where user is your sudo user and some_command the command you want to run with fabric, then on the fabric script run sudo it with shell=False:

sudo('some_command', shell=False)

this works for me

Solution 5:

In your /etc/sudoers file, you could add

user ALL=NOPASSWD: /bin/bash

...where user is your Fabric username.

Obviously, you can only do this if you have root access, as /etc/sudoers is only writable by root.

Also obviously, this isn't terribly secure, as being able to execute /bin/bash leaves you open to essentially anything, so if you don't have root access and have to ask a sysadmin to do this for you, they probably won't.