requiretty about puppet-sudo

[saz]

This isn't as easy as it sounds, as all sudoers files are... files. All of them must be migrated to templates just for one parameter.

A better way would be, to have the RHEL6 sudoers file the same as is delivered during installation of sudo, which means to drop Defaults requiretty.

But, Defaults requiretty is a security thing and I'm not quite sure, that RHEL6 is delivering a sudoers config without requiretty enabled. Are you sure, your config is the original file?

As every file included in /etc/sudoers.d overwrites global settings, isn't it possible to use a sudoers.d entry to overwrite requiretty?

I'm closing this issue, as I don't think there is really a change required in the behavior of this module, but feel free to give some more information on this and I might reconsider my current decision.

[stjeanp]

Actually, I've run in to this as well. My Jenkins server has some tests that need to be run as root, but sudo chokes on that unless it's disabled. Yes, this is an edge case, but there's not really a good way to use this module to manage sudoers for the edge cases since we can't change the config values.

And using r10k to manage your environments makes it difficult to simply replace the sudoers file in the module because dynamic environments.

So I've resorted to overriding the source parameter in the profile class which includes the ssh module.

You've got a great module for managing sudoers permissions, but it's lacking as far as managing the actual sudoers configuration.

[djjudas21]

@stjeanp I found a workaround. You can specify a higher-priority sudo rule that grants requiretty access.

  sudo::conf { 'sudoers-requiretty':
    priority => 5,
    content => 'Defaults:%sudoers !requiretty',
  }

  sudo::conf { 'sudoers':
    priority => 10,
    content  => "%sudoers ALL=(ALL) ALL",
  }

[saz]

@stjeanp Please feel free to suggest things, which could be improved (extra points for a PR). And, as @djjudas21 shows and I've suggested in my original reply, there isn't a real case, where an option in the main sudoers config can't be overwritten. In fact, this is the right way.

Think about it, if you want requiretty for one user, but not for the other.