Need help setting up sudo?

Question

linux

Hello. Please read the question before downvoting "nubolinuksoid".
You need to allow a specific user to execute 2 scripts via sudo. And that's it. Only 2 scripts.
In this regard, the following entry appeared in /etc/sudoers:

username ALL=NOPASSWD:/home/username/hard_update.sh, /home/username/update.sh

When trying to execute one of the scripts, a password is requested, and after entering the correct user password, I get the following whack: Sorry, user username is not allowed to execute '/home/username/update.sh' as ​​www-data on hostname.domain.ru.
I start like this:
sudo -u www-data /home/username/update.sh
OS - Debian 6.0.1 (squeeze)
Maybe it's a matter of rights? The rights to the home directory are now 700, to the scripts 766.
But I already played with the rights as best I could.
Previously, there was already such a problem on centos. At that time, the inflamed brain gave birth to such a crutch:

username ALL=/home/username/hard_update.sh, /home/username/update.sh<br/>
username ALL=(ALL) NOPASSWD:/home/username/hard_update.sh, /home/username/update.sh

and sudo worked. Now it was necessary to repeat the focus on debian, but ...

Answer 1

Cmnd_Alias ​​RUNASAPACHE /home/username/hard_update.sh, /home/username/update.sh
username ALL=(www-data) NOPASSWD: RUNASAPACHE
and then
sudo -u www-data /home/username/hard_update.sh
sudo -u www -data /home/username/update.sh
will run as apache and not as root

Answer 2

Specially checked now on another host with 6.0.2
Everything works fine.

Answer 3

Maybe try another option:
Add to sudoers the launch of all commands from the script, and not the script itself.

Answer 4

Add to sudoers the launch of all commands from the script, and not the script itself.

I agree, specifying scripts in allowed commands is a huge hole in the security of the system.
After all, an attacker can add anything to scripts.