vfclists · 2022-12-31 08:06
If I have an `admin` account on a remote server, how do I execute a `sudo` command on the remote after logging in as admin?
The main problem seems to be responding to the password prompt for the sudo user.
I have been doing it as `root` after setting the ssh key for the session, directly in org-babel files where I use `ssh root@host 'command` in a local script as well as remotely where I set `:dir /ssh:root@host:~/workingirectory`, but I think that is unsafe and I want to do it as an admin user with `sudo`.
[deleted] · 2022-12-31 08:54
[deleted]
ftrx · 2022-12-31 09:10
You do not look much for org-babel than for TRAMP, or more specifically
#+begin_src shell :dir /sshx:user@host|sudo:host:/a/path
ls -l
#+end_src
where host can be a name or an IP.
in TRAMP config terms
(use-package tramp
:ensure nil
:config
(put 'temporary-file-directory 'standard-value '("/tmp"))
:custom
(tramp-default-method "sshx")
(tramp-ssh-controlmaster-options ""))
on some systems, like NixOS you might need also
(use-package tramp-sh
:ensure nil
:after tramp
:config
(add-to-list 'tramp-remote-path "/run/current-system/sw/bin"))
more about remote shell setup https://www.gnu.org/software/emacs/manual/html_node/tramp/Remote-shell-setup.html
PS in safety terms password-based ssh logins are not super safe... Meanwhile direct root login is considered *mildly* unsafe because root is a predictable user name and you might not need root privileges all the time in a session. The main reason for sudo as a mere `su` replacement to became `root` is logging who did what, and allow many users to be admin without shared credentials. If you are the sole admin of a host and you have some ssh safeguards like rate limiting logins attempts and so on (i.e. fail2ban or a modern fw good config) there is no meaningful extra safety not using root directly.