0

I have a script to automate starting a few servers on the terminal. These are server processes of the software I am developing. They can be recompiled and changed multiple times a day. The binaries can live in different places (working copies).

My script uses

 set sudo to do shell script "sudo -v "

to ask for the root password once, then creates a new iterm2 terminal window (and some tabs) and tries to start the servers with sudo:

#!/usr/bin/osascript
on run args
    set sudo to do shell script "sudo -v " -- to ask for password once only
    tell application "iTerm"
        create window with default profile
        tell current window
            tell current session
                write text "sudo /some/server"
            end tell
            -- more tabs and more sudos go here
        end tell
    end tell
end run

Everything worked fine on El Capitan, but not on High Sierra.

If the sudo password is not cached, the sudo -v asks for my password and then proceeds --- as expected. If I ran sudo before and the password is cached, the sudo -v does not ask for a password, again, as expected. But in both cases each of the subsequent sudos in the new window does ask for my password, making the whole thing inconvenient.

When I add with administrator privileges to the initial sudo it does ask for my password in a popup dialog but the following sudo calls with write text still ask for the password on the shell. (I use write text and the terminal to keep an eye on these servers' outputs.)

I can run regular sudo commands just fine and it does cache the password.

How can I use sudo in Applescript in a new iTerm2 window and have it ask for the password only once?

EDIT: Looks like this is not related to Applescript but to iterm and High Sierra. When I open a terminal window with 2 tabs, I need to enter my password in both when I run e.g., sudo ls. After that both tabs have the sudo password cached, but running sudo in one tab does not make the other tab use the cached sudo password.

So the real question is probably: how do I get iTerm2 to cache the sudo password and share that between tabs and windows?

  • 1
    Have you considered setting these executables to run as root without a password, in the sudoers file? Have a look at the manual page for sudoers. – user3439894 Jan 24 '18 at 17:38
  • set thePassword to "Password" as string do shell script <<YourCommand>> ¬ password thePassword with administrator privileges – Gio Valerio Jan 24 '18 at 18:23
  • 2
    @Gio Valerio, Personally I'd set the executables to run as root without a password, in the sudoers file before using password with administrator privileges as the password is saved in plain text within the AppleScript file. – user3439894 Jan 24 '18 at 18:30
  • 1
    @Allan, I think while interesting, nonetheless the questions you've asked do not really address the issue, which is the OP has a script that works as intended and wanted in OS X 10.11 but not in macOS 10.13. Having run the script in each version of the OS, I see exactly what is being talked about. In OS X 10.11 if I run sudo <script_name>, I'm prompted for my password and then the script runs all of the write text "sudo /some/server"` commands without prompting again for a password. In macOS 10.13, all of the write text "sudo /some/server" commands wait for me to input the password again. – user3439894 Jan 24 '18 at 22:03
  • 1
    @Allan, You stated "sudo will not cache credentials in separate shells" and that is not totally true, case in point! I can reproduce the OP's issue! In OS X 10.8.6 and OS X 10.11.6 his script works as wanted and intended however, is does not work in macOS 10.13.1 as it did in OS X 10.8.6 and OS X 10.11.6. So, something changed between OS X 10.11.6 and macOS 10.13.1 that I tested under. So while "sudo will not cache credentials in separate shells." is true in macOS 10.13.1 it is not true in OS X 10.8.6 and OS X 10.11.6 as tested. I'll admit I didn't think it would work but it did! – user3439894 Jan 24 '18 at 22:59
1

Try adding:

Defaults !tty_tickets

to /etc/sudoers. Tested on 10.13.6 (High Sierra).

From the man page:

If set, users must authenticate on a per-tty basis. With this flag enabled, sudo will use a separate record in the time stamp file for each tty. If disabled, a single record is used for all login sessions. This flag is on by default.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .