For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at https://superuser.com/questions/164078/how-to-make-shared-keys-ssh-authorized-keys-and-sudo-work-together. I've also attempted to disable password-based authentication by making /etc/pam.d/sudo read as follows:


auth    required   pam_env.so readenv=1 user_readenv=0
auth    required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0
auth    [success=1 default=ignore]   pam_ssh_agent_auth.so file=/etc/security/authorized_keys
auth    requisite  pam_deny.so
auth    required   pam_permit.so
auth    optional   pam_cap.so

@include common-account
@include common-session-noninteractive

It seems to work, but I wanted to check to make sure that I wasn't overlooking a massive security hole. Also, if I try to use sudo without having a private key, it tries three times before failing:

Sorry, try again.
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts

This isn't a terribly big deal, but I do get a security warning e-mail every time, so it would be nice to make it only try once.

1 Answer 1


You should be able to change this:

auth    [success=1 default=ignore]   pam_ssh_agent_auth.so file=/etc/security/authorized_keys

to this:

auth    [retry=1 success=1 default=ignore]   pam_ssh_agent_auth.so file=/etc/security/authorized_keys

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .