sudo - why do you torture me so.. ;-)

sudo is certainly one of the most important aspects of *nix administration.
Recently I had been tasked with allowing a number of individual users (which we could have created an OS group to contain) to sudo to another user, without a password.  That user should then be able to run some specific commands, also without a password.

NOTE:  If you happen across this post, and know of a better way to do this, feel free to correct me.  This just happened to have worked for me and seemed clean and easy to follow.

This is what I had come up with:


/* Allow APPUSERS (techies) to
        su to approot without a password
    Allow approot to
        run specific commands without a password
        on APPHOSTS (localhost)
*/

[root@localhost ~] # adduser approot
[root@localhost ~] # visudo

## TESTING
## ALIASES
Host_Alias      APPHOSTS = cypher,cypher.matrix.private
User_Alias      APPUSERS = techies,user1
Cmnd_Alias      APPCMND = /usr/bin/systemctl restart ntpd.service, /bin/cat /etc/shadow
Cmnd_Alias     APPSUDOALL = ALL

## SUDO COMMANDS
APPUSERS ALL = NOPASSWD: /bin/su - approot
approot APPHOSTS = NOPASSWD: APPCMND, APPSUDOALL

[root@cypher ~]# su - techies
-bash-4.2$ sudo /bin/su - approot
[approot@cypher ~]$ sudo cat /etc/shadow
root:$6$zH.........