Should I use NOPASSWD?

For automation, yes - a job cannot type a password. For people, the password prompt is an extra check worth keeping.

Why must commands be absolute paths?

sudo matches the full path, so `git` alone would not match anything and a relative path could be swapped for a different program. Find the real path on the server with `command -v git`.

How do I see what an account is allowed to run?

Run `sudo -l -U username` as an administrator, or `sudo -l` as the account itself.

Free tool · no account

Least-privilege sudoers rule generator

Let a deploy user, a CI job, or a support engineer run exactly the commands they need as another account, and nothing else. The generator writes a drop-in file for /etc/sudoers.d, escapes what sudo requires, and warns when a command would quietly hand over a full shell.

Who runs sudo (user or %group)

Runs the commands as

Allowed commands, one per line

Absolute paths. Arguments you write are the only ones allowed; a bare path allows any arguments, and path "" allows none.

Rule name

Names the file in /etc/sudoers.d and the command alias.

No password prompt (NOPASSWD) - for automation

/etc/sudoers.d/deploy-runbook

# /etc/sudoers.d/deploy-runbook
# Check with visudo before installing. Lets
# ubuntu run these commands as deploy, and nothing else.
Cmnd_Alias DEPLOY_RUNBOOK = /usr/bin/git -C /var/www/app pull --ff-only, \
    /usr/bin/php /var/www/app/artisan migrate --force

ubuntu ALL=(deploy) NOPASSWD: DEPLOY_RUNBOOK

git can start a shell or write files, so allowing it gives ubuntu everything deploy can do. Wrap the task in a script owned by root and allow that instead.
php can start a shell or write files, so allowing it gives ubuntu everything deploy can do. Wrap the task in a script owned by root and allow that instead.

Install it

sudo visudo -cf deploy-runbook
sudo install -m 0440 -o root -g root deploy-runbook /etc/sudoers.d/deploy-runbook
sudo -l -U ubuntu

Save the file locally first. visudo -c checks it, so a typo cannot lock everyone out of sudo; sudo -l -U shows what the account may now run.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

The same pattern, checked for you

Shortspan runbooks run each step as sudo -n -u <run-as> -- <step>, and shortspan ssh check verifies the sudo rule, file ownership, and deploy key before the first run.

Create a free workspace See what Shortspan does

Commands that grant everything

Many ordinary programs can start a shell or write any file when run under sudo: editors, pagers, interpreters, find, tar, git, systemctl, and more (GTFOBins catalogues them). Allowing one of them allows everything the run-as account can do. When a task needs one, put it in a script owned by root and allow the script instead.

Arguments are part of the rule

In sudoers, a command with arguments allows exactly those arguments. A bare path allows any arguments, and path "" allows none. Wildcards also match spaces, so they allow more than they appear to. The commas, colons, equals signs, and backslashes sudo treats specially are escaped for you.

Installing it safely

Check the file with visudo -cf before installing it with mode 0440 - a syntax error in sudoers can lock everyone out of sudo. Files in /etc/sudoers.d whose names contain a dot or end in ~ are skipped, so the generator never produces one.

Common questions

Should I use NOPASSWD?: For automation, yes - a job cannot type a password. For people, the password prompt is an extra check worth keeping.
Why must commands be absolute paths?: sudo matches the full path, so git alone would not match anything and a relative path could be swapped for a different program. Find the real path on the server with command -v git.
How do I see what an account is allowed to run?: Run sudo -l -U username as an administrator, or sudo -l as the account itself.

More free tools