Freebsd – How to make a normal user can install package with `pkg_add` on FreeBSD

freebsdinstallationpackagespermissionssudo

How to make a normal user can install package with pkg_add on FreeBSD?

pkg_add -r command fails with normal user with sudo. Downloading succeeds, but installation fails with this error message. Equal command executed successfully with root login.

%sudo pkg_add -r apache22
Password:
Error: Unable to get ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/apache22.tbz: Syntax error, command unrecognized
pkg_add: unable to fetch 'ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-8.1-release/Latest/apache22.tbz' by URL
%

Assume my username as eonil.

I added

eonil ALL=(ALL) ALL

code as next of

root ALL=(ALL) ALL

via visudo, and added the user to wheel group by

pw usermod eonil -G wheel

. But the user cannot install package with sudo pkg_add -r apache22. (not only the apache, any package.)

Best Answer

Problem in env vars.

Uncomment or add line in sudoers(run visudo command):

Defaults        env_keep += "PKG_PATH PKG_DBDIR PKG_TMPDIR TMPDIR PACKAGEROOT PACKAGESITE PKGDIR FTP_PASSIVE_MODE"

Related Solutions

Freebsd – How to install DHCP server on FreeBSD 7.2

Way more programs you can find in FreeBSD's ports collection. First you need to checkout ports.

portsnap fetch extract

then ones a day/week/month you should run portsnap fetch update to update collection (not programs them selfs)

After ports are extracted you can find one you want and install it:

cd /usr/ports
make search name=isc-dhcp
cd /usr/ports/net/isc-dhcp31-server
make install clean

PS. And it'll be good to read handbook first

Easy Multi-Level Authentication for Sudo – Implementation Guide

You already solved this via OTPs (more security = more hoops), and I cannot comment on pam_ssh_agent_auth. But it seems as though your real concern is not with sudo but with network-level access. In other words, you seem concerned with privileges granted to users from a particular host or hosts rather than a particular system account. If that's so, consider implementing a port-knocking scheme in front of your SSH daemon, such that SSH is only accessible from specific IPs and by someone who knows the secret knock. After that, regular old public key authentication from known hosts should be sufficient. If an attacker can still gain shell access at that point, you're probably outmatched anyway.

The only other scenario I can think of is to use an ssh proxy on a trusted host that you can bounce your connections off of when you're on an untrusted network (and since you're in bsdworld, you can even use a jail on your host that does exactly that). As far as I'm concerned, any box that an attacker has shell access on is completely compromised, period. Whether they then get root creds or not is entirely moot. Your effort may best be spent preventing that first successful incursion.

Cheers, -G

Best Answer

Related Solutions

Freebsd – How to install DHCP server on FreeBSD 7.2

Easy Multi-Level Authentication for Sudo – Implementation Guide

Related Topic