How to Use Sudo in Bash Scripts on Ubuntu

This guide explains how to execute administrative commands within bash scripts on Ubuntu using sudo. It covers running scripts with elevated privileges, handling password prompts, verifying root access inside the script, and configuring passwordless sudo for automation while highlighting essential security considerations.

Running the Script with Sudo

The most straightforward method to use sudo in a bash script is to execute the entire script with elevated privileges. Instead of placing sudo before every command, run the script itself using sudo. This ensures all commands within the file have the necessary permissions.

sudo ./myscript.sh

When you run the script this way, you will be prompted for your password once at the beginning. All subsequent commands inside the script will inherit root privileges.

Using Sudo for Specific Commands

If you prefer not to run the entire script as root, you can prefix individual commands with sudo. This is useful when only specific tasks require administrative access.

#!/bin/bash

echo "Updating package list"
sudo apt update

echo "Installing nginx"
sudo apt install -y nginx

Be aware that this method may prompt for a password for each sudo command unless your sudo timeout is still active or you have configured passwordless sudo.

Checking for Root Privileges

It is best practice to check if the script is running with the required permissions before executing critical commands. You can check the effective user ID (EUID) at the start of your script.

#!/bin/bash

if [ "$EUID" -ne 0 ]; then
  echo "Please run as root"
  exit
fi

# Rest of the script

This prevents errors caused by permission denial and informs the user to execute the script with sudo.

Configuring Passwordless Sudo

For automated tasks like cron jobs, password prompts will cause the script to hang. You can configure specific scripts to run without a password by editing the sudoers file. Always use the visudo command to edit this file safely.

Open the sudoers file:
```
sudo visudo
```
Add the following line at the end, replacing username and script_path:
```
username ALL=(ALL) NOPASSWD: /full/path/to/script.sh
```

This allows the specified user to run that specific script with sudo without entering a password.

Security Best Practices

Using sudo in scripts carries security risks. Avoid running entire scripts as root unless necessary. When configuring passwordless sudo, restrict permissions to only the specific commands or scripts required. Never grant NOPASSWD access to all commands for a user, as this compromises system security. Always validate input within scripts that run with elevated privileges to prevent injection attacks.