2

I'm creating users using Puppet. Here's the gist of what I'm doing in Puppet:

user { 'ntkay':
    name => 'ntkay',
    uid  => 10000,
    home => '/home/ntkay',
    managehome => true,
    shell => '/bin/bash',
    groups => ['sudo', 'adm'],
}

This creates my user and I can log in with SSH using auth keys. However, when I do sudo, I see:

[sudo] password for ntkay:

The ubuntu user on this same system doesn't prompt for password on sudo and is member of the same groups. ntkay doesn't even have a password in the above configuration. How can I fix this issue?

  • 2
    man sudo man sudoers – MoonSweep Mar 31 '15 at 0:54
  • I know that there's a NOPASSWD option, but _how is the ubuntu user doing sudo without a password?` The configuration is set to allow anyone in the sudo group to %sudo ALL=(ALL:ALL) ALL, but that presumes a password is present. How does ubuntu bypass this? – Naftuli Kay Mar 31 '15 at 1:05
  • 1
    @NaftuliTzviKay are you use there is nothing in /etc/sudoers.d, such as something placed by cloud-init? – jordanm Mar 31 '15 at 4:46
  • @jordanm Please submit this as an answer and you'll have my upvote and the accepted answer. (contents of 90-cloud-init-users is ubuntu ALL=(ALL) NOPASSWD:ALL). – Naftuli Kay Mar 31 '15 at 17:52
3

In addition to /etc/sudoers, sudo will also read files in the /etc/sudoers.d directory. The cloud-init application, commonly used on AWS instances, places a sudoers configuration in that directory for allowing the default user to sudo without a password.

  • 1
    Please note that the directory may appear empty, but it might not be: directory permissions are drwxr-x---, meaning that if you're not root:root, you can't ls it. – Naftuli Kay Mar 31 '15 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.