2 code formatting
source | link

I'd suspect that your box is attempting to contact an external authentication service (think of NIS/LDAP) using PAM...

If I understand PAM right, you wouldn't be able to see the PAM lookup in your strace calls. I'd suggest that you run tshark/tcpdump and see if you can correlate specific network traffic to your sudo attempts. Suspects here would be DNS lookups &| LDAP calls.

tcpdump -i eth0 -w network.pcap -s0 -Av

tcpdump -i eth0 -w network.pcap -s0 -Av

If you do find out what's causing the lookups, find out the relevant PAM module to edit and fix the issue. Alternatively, if it's a DNS lookup, just add an /etc/hosts entry to fake the name and redirect to localhost. This will make your sudo fast since the lookup will be fast and will redirect to the localhost and the network transaction will fail fast since there's nothing listening on localhost...

I'd suspect that your box is attempting to contact an external authentication service (think of NIS/LDAP) using PAM...

If I understand PAM right, you wouldn't be able to see the PAM lookup in your strace calls. I'd suggest that you run tshark/tcpdump and see if you can correlate specific network traffic to your sudo attempts. Suspects here would be DNS lookups &| LDAP calls.

tcpdump -i eth0 -w network.pcap -s0 -Av

If you do find out what's causing the lookups, find out the relevant PAM module to edit and fix the issue. Alternatively, if it's a DNS lookup, just add an /etc/hosts entry to fake the name and redirect to localhost. This will make your sudo fast since the lookup will be fast and will redirect to the localhost and the network transaction will fail fast since there's nothing listening on localhost...

I'd suspect that your box is attempting to contact an external authentication service (think of NIS/LDAP) using PAM...

If I understand PAM right, you wouldn't be able to see the PAM lookup in your strace calls. I'd suggest that you run tshark/tcpdump and see if you can correlate specific network traffic to your sudo attempts. Suspects here would be DNS lookups &| LDAP calls.

tcpdump -i eth0 -w network.pcap -s0 -Av

If you do find out what's causing the lookups, find out the relevant PAM module to edit and fix the issue. Alternatively, if it's a DNS lookup, just add an /etc/hosts entry to fake the name and redirect to localhost. This will make your sudo fast since the lookup will be fast and will redirect to the localhost and the network transaction will fail fast since there's nothing listening on localhost...

1
source | link

I'd suspect that your box is attempting to contact an external authentication service (think of NIS/LDAP) using PAM...

If I understand PAM right, you wouldn't be able to see the PAM lookup in your strace calls. I'd suggest that you run tshark/tcpdump and see if you can correlate specific network traffic to your sudo attempts. Suspects here would be DNS lookups &| LDAP calls.

tcpdump -i eth0 -w network.pcap -s0 -Av

If you do find out what's causing the lookups, find out the relevant PAM module to edit and fix the issue. Alternatively, if it's a DNS lookup, just add an /etc/hosts entry to fake the name and redirect to localhost. This will make your sudo fast since the lookup will be fast and will redirect to the localhost and the network transaction will fail fast since there's nothing listening on localhost...