Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've gone through the Google searches, but the results always have an extra clue that I'm not seeing. The error:

[testuser@testhost] $ sudo -ll
sudo: no valid sudoers sources found, quitting
sudo: unable to initialize policy plugin

That's it. No parse errors in /etc/sudoers, nothing.

  • /etc/sudoers is owned by root:root and has 0440 permissions.
  • I ran visudo to uncomment the included %wheel group privilege.
  • My test user is a member of wheel.
  • I've even removed and reinstalled sudo-1.8.6p3-7.el6.x86_64 on this RHEL 6.4 test VM.

What else can I look at?

Answers to questions:

  • The VM I'm testing on is secure; I can't copy/paste to an outside site. (I'm asking this question from a different host outside the firewall.) stat /etc/sudoers shows a regular file of size 4000 and access 0440. The contents of the file are default (via the remove and reinstall) with the exception of the %wheel group being uncommented.
  • ls -ld /etc/sudo* shows
    • /etc/sudo.conf (0640, root:root)
    • /etc/sudoers (0440, root:root)
    • /etc/sudoers.d (0750, root:root, empty directory)
    • /etc/sudo-ldap.conf (0640, root:root)

The overall goal is privileges via ldap, which I've done before successfully.

Thanks!

[CORRECTION: The uncommented %wheel group is not password-free. The test user must enter a password for wheel privileges.]

[UPDATE 1011h: Modifying /etc/sudo-ldap.conf with the correct sudoers_base got me access to the LDAP database (anonymous bind during testing) and a successful result to sudo -ll. That's a workaround for me, but doesn't solve the initial problem of whatever is preventing sudoers from working locally.]

share|improve this question
    
What is the output of stat /etc/sudoers, and cat /etc/sudoers? –  Chris Down Mar 25 '13 at 16:18
    
Is sudoers.d directory also owned by root:root? Just covering all bases first. –  darnir Mar 25 '13 at 16:20
    
What do you have for sudoers: in /etc/nsswitch.conf? –  Patrick Mar 25 '13 at 23:15
add comment

1 Answer

up vote 0 down vote accepted

Modifying /etc/sudo-ldap.conf with correct information got me a good result to sudo -ll for my test user. I count that is a workaround, though. It doesn't solve the problem of why sudo won't work with solely local information.

share|improve this answer
1  
As an idea, you might check nsswitch.conf to see if "files" is one of the configured sources for sudo. –  Joel Davis Mar 25 '13 at 17:27
    
The sudoers setting in nsswitch.conf is "files ldap." Once I'm done proving LDAP's utility to my bosses, I'll switch those on all clients.... ;-) –  dafydd Apr 1 '13 at 3:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.