Can I prevent fabric from prompting me for a sudo password?

Try passing shell=False to sudo. That way /bin/bash won't be added to the sudo command. sudo('some_command', shell=False)

From line 503 of fabric/operations.py:

if (not env.use_shell) or (not shell):
    real_command = "%s %s" % (sudo_prefix, _shell_escape(command))

the else block looks like this:

                                             # V-- here's where /bin/bash is added
real_command = '%s %s "%s"' % (sudo_prefix, env.shell,
    _shell_escape(cwd + command))

In your /etc/sudoers file add

user ALL=NOPASSWD: some_command

where user is your sudo user and some_command the command you want to run with fabric, then on the fabric script run sudo it with shell=False:

sudo('some_command', shell=False)

this works for me

This is the most direct answer to your question: You do not actually have a problem; you misunderstand how Fabric run() and sudo() work.

Your "workaround" is NOT a workaround it is the 100% valid answer to the problem.

Here's a simple set of rules: 1) Use "run()" when you don't expect a prompt. 2) use "sudo()" when you do expect a prompt. (this should be true for all or most commands requiring a prompt, even if the executable in question is not Bash or Sudo).

This same answer applies to folks trying to run commands under "sudo". Even if sudoers has passwordless config for the current user on some system, if you use sudo() instead of run() then you will force a prompt (unless the Fabric code already contains an ENV password or key).

BTW the author of Fabric answered my question - very similar to your question - in #IRC. Nice guy, one of the unsung heroes of open source for persisting in his Fabric and Paramiko work.

...In my test environment, there is always 1 username which has full password-less access to sudo. Typing sudo echo hello will not prompt me. Furthermore, that sudo user is configured with "!requiretty" so all commands can run over SSH (like SSH hopping between hosts). This means I can simply use "run()" with to execute "sudo something", but it's just another command which runs without a prompt. As far as security is concerned, it is someone's job to lock down a production host but not a test host. (If you are being forced to test things by and and can not automate, that is a huge problem).

You can use:

from fabric.api import env
# [...]
env.password = 'yourpassword'