0

I'm building a LEMP stack script powered by bash scripts and CLI aliases. For security reasons, all of the bash scripts, and the stack config file (also bash syntax) are owned by root:root.

I added some bash alias commands for easier management inside the sudo user .bashrc file to save keystrokes when the sudo user wants to run a bash script.... these work great, however, I'd like to expand these by allowing certain alias commands to integrate with variable options defined in the stack config file.

For example, SITE_NOINDEX is defined in the config file owned by root:root and maybe I want to have a bash alias available to the sudo user to view this option's value.

The problem is that the config file is chmod 0700 for security reasons, and it seems the easiest fix is to change all the bash scripts and config file to 0740 and either add the sudo user to group "root" or change the ownership of all scripts to be something less secure like root:sudo which seems a little bit goofy... is there a better solution here?

Edit: currently Permission denied error is given if I try to simply source the stack config file inside sudo user's .bashrc file (after trying to restart bash session). The rest of the normal aliases work fine but none of the shell variables in the config file are readable with current permissions.

Related: How to secure a sudo - powered script

Related: What's the best, secure way to share some .bashrc source between users and root?

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Jesse Nickles
  • 185
  • Also adding that I can't (or don't want) to create yet another "shared bashrc" file with relaxed permissions for both "root" and "sudo" users to share as per the linked question, because it adds more work and confusion, esp. when I'm setting this up for new companies. I'm trying to keep things simple and only define variables a single time in the config file. – Jesse Nickles Aug 12 '22 at 19:28
  • You don’t want a split .bashrc, which is understandable; but how about a split configuration file? You’d have one with root-only settings (root:root, permissions 0700), and one with non-confidential settings (root:root still, but permissions 0755). – Stephen Kitt Aug 23 '22 at 08:43
  • Thanks @StephenKitt and yes, I'm afraid that might be the only solution besides adding the sudo user to the root group (or root user to sudo group)... neither one is deal. It either breaks "single source of truth" or requires messy user groups! – Jesse Nickles Aug 23 '22 at 10:31

0 Answers0