This topic describes the rationale behind specific sudo privilege requirements for virtualizing MSSQL databases on Linux, along with a few default commands. As required by the MSSQL connector, you must grant the OS account the following key privileges:

  1. Disable requiretty: The Delphix Continuous Data Engine requires the requiretty setting to be disabled. This allows the OS user to run sudo commands without a logged-in terminal session (tty).

  2. Add NOPASSWD: By including the NOPASSWD qualifier, you ensure that the sudo command does not prompt for a password when executing certain commands such as mount, umount, mkdir, rmdir, and ps.

In the example configurations, the OS username delphix_os is used. Modify the username based on the OS user available in your environment for linking and provisioning operations.

The delphix_os OS user must also be a member of the mssql group. This can be either the primary or secondary (supplementary) group.

Since all staging and target hosts use the same privilege elevation profile, configure all hosts with one identical OS user that uses privilege elevation to execute MSSQL workflows.

Procedure

Perform the following steps on both staging and target environments.

  1. Open the sudoers file with visudo, which validates syntax before saving and helps prevent lockouts:

    visudo

    If you edit /etc/sudoers directly with vi, run visudo -c afterward to check for syntax errors before closing your session.

  2. Add the following snippet to grant the required privileges to the delphix_os user:

    Defaults:delphix_os !requiretty
delphix_os ALL=NOPASSWD: \
    /bin/mount, /bin/umount, /bin/mkdir, /bin/rmdir, /bin/ps

  3. Save and exit. Changes take effect immediately. No service restart or reboot is required.

If the Delphix OS user is not the mssql OS user itself, and the Delphix OS user is a member of the mssql group, configure privilege elevation as described in Privilege elevation requirements.

Privilege elevation requirements

The privilege elevation feature allows a non-privileged OS user (for example, delphix_os) to gain the permissions of a privileged OS user (for example, mssql) for operations on the staging or target environments.

This configuration is required whenever the Delphix OS user is not the mssql OS user itself.

Even in this case, the Delphix OS user must still be a member of the mssql group (primary or secondary).

Add the following entry to the sudoers file to allow the Delphix OS user to run commands as mssql without a password.

Example

Defaults:delphix_os !requiretty
delphix_os ALL=(root) NOPASSWD: \
    /bin/mount, /bin/umount, /bin/mkdir, /bin/rmdir, /bin/ps
delphix_os ALL=(mssql) NOPASSWD: ALL

Restricting scope for tighter security (Optional)

Granting ALL under (mssql) gives delphix_os unrestricted command execution as mssql. For tighter security, scope both RunAs entries to specific mount paths and commands the connector needs, following the pattern shown in Verifying the configuration:

delphix_os ALL=(root) NOPASSWD: \
    /bin/mount /local/mssql/MSSQLSERVER/*, /bin/mount * /local/mssql/MSSQLSERVER/*, \
    /bin/umount /local/mssql/MSSQLSERVER/*, /bin/umount * /local/mssql/MSSQLSERVER/*, /bin/umount -lf /local/mssql/MSSQLSERVER/*, \
    /bin/mkdir -p -m 775 /local/mssql/MSSQLSERVER/*, /bin/mkdir -p /local/mssql/MSSQLSERVER/*, /bin/mkdir /local/mssql/MSSQLSERVER/*, /bin/rmdir /local/mssql/MSSQLSERVER/*, \
    /bin/mkdir -p -m 775 /opt/delphix/*, /bin/mkdir -p /opt/delphix/*, /bin/mkdir /opt/delphix/*, /bin/rmdir /opt/delphix/*, \
    /bin/ps
delphix_os ALL=(mssql) NOPASSWD: \
    /bin/mkdir *, /bin/rmdir *, /bin/chmod * /local/mssql/MSSQLSERVER/*, /bin/du * /local/mssql/MSSQLSERVER/*, \
    /usr/bin/test -f /local/mssql/MSSQLSERVER/*, /usr/bin/test -d /local/mssql/MSSQLSERVER/*, \
    /bin/rm -f /local/mssql/MSSQLSERVER/*, /bin/rm -rf /local/mssql/MSSQLSERVER/*, /bin/mv * /local/mssql/MSSQLSERVER/*, \
    /bin/cat /local/mssql/MSSQLSERVER/*, /usr/bin/tee /local/mssql/MSSQLSERVER/*, /bin/df, \
    /bin/sh -c *
Path-scoped entries limit blast radius if delphix_os is compromised, but they require updates whenever mount paths change. Confirm paths and commands against your environment because this example mirrors the verification output, not a fixed requirement.
The backup-file listing operation runs as sudo -u #<uid> sh -c '...' so sudoers can only allowlist the whole sh -c invocation, not individual commands inside it. If that is unacceptable, keep (mssql) as ALL instead of scoping it.

Verifying the configuration

Run sudo -ll as the Delphix OS user and confirm entries similar to the following:

[delphix_os@amn015365 Euclid]$ sudo -ll

User delphix_os may run the following commands on amn015365:

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        /bin/mount /local/mssql/MSSQLSERVER/*
        /bin/mount * /local/mssql/MSSQLSERVER/*
        /bin/umount /local/mssql/MSSQLSERVER/*
        /bin/umount * /local/mssql/MSSQLSERVER/*
        /bin/umount -lf /local/mssql/MSSQLSERVER/*
        /bin/mkdir -p -m 775 /local/mssql/MSSQLSERVER/*
        /bin/mkdir -p /local/mssql/MSSQLSERVER/*
        /bin/mkdir /local/mssql/MSSQLSERVER/*
        /bin/rmdir /local/mssql/MSSQLSERVER/*
        /bin/mkdir -p -m 775 /opt/delphix/*
        /bin/mkdir -p /opt/delphix/*
        /bin/mkdir /opt/delphix/*
        /bin/rmdir /opt/delphix/*
        /bin/ps

Sudoers entry:
    RunAsUsers: mssql
    Options: !authenticate
    Commands:
        ALL
Last updated
Oct 9, 2026