HermesWatcher
Search⌘K For brandsSetup help
StartStart hereSetup plannerInstall Hermes AgentChat from your phoneYour first 24 hours
Use casesWorkflow blueprintsCase studiesUse-case collectionsCommunity libraryPrompt library
LearnWhat is Hermes Agent?Guideswitcheer's WingtipsTopicsFAQCommand cheat sheetGlossarySOUL.md gallery
ToolsTools & integrationsAll messaging platformsSkills directoryPlugins directorySkills, plugins & MCP
TroubleshootReleases
Work with usServicesNewsletterFor brands: partner with usFor AI agentsContactAboutFollow @HermesWatcher on X ↗ (opens in a new tab)

witcheer's Wingtips #40: give your local agent two commands, not root

Republished in his own words, with credit.

witcheerBy witcheer · Nous Research

Back to wingtips

#40 · give your local agent two commands, not root

· Security & approvals · CLI / Gateway

Hermes Wingtips #40: give your local agent two commands, not root

when I'm running benchmarks, my local Hermes Agent stops and starts the model server on its own, from cron, with no password. it still cannot touch anything else as root.

the trick is a sudoers rule scoped to exactly one service: NOPASSWD applies to systemctl start and stop for that unit, nothing more.

still test the fence from the outside: sudo -n on any other service should still ask for a password.

SourcesHermes docs: Security

All tips are written by witcheer and collected here with credit. Card images stay on his X posts.

witcheer says each tip ran on a real Hermes box before it shipped. Hermes changes fast, so check your version and the linked doc.