Checking sudoers without root?

Question

Basically, I have a preseed Debian install that runs a postinstall bash script as root on first login. This script should edit sudoers to make passwords optional when any user in the sudo group uses sudo:

sed -i.bak 's/%sudo     ALL=(ALL:ALL) ALL/%sudo ALL=(ALL) NOPASSWD:ALL/' /etc/sudoers

However, something seems to have gone wrong and users still require a password to use sudo - long story short this effectively means no one has sudo as all users are created with --disabled-password. Yes, I realize this may not be the ideal/right/smart/secure way but it is what it is.

What I need to figure out is, what went wrong? Why? The script has worked every other time I've used it and it obviously ran other commands such as updating certain packages, so why didn't it properly edit /etc/sudoers? How can I check sudoers without root or otherwise figure out why it failed to edit?

Answer 1

Well, we can't really guess, because it's dependant on your environment. My money would be on the line you're trying to replace, not existing in /etc/sudoers. (At least, not exactly as it appears). Which would mean it never got replaced, and so it never got set 'NOPASSWD'.

I mean, you're relying on a specific number of space in there, and a specific line format, and if it doesn't match your regex in the first place... it'll never get modified.

I would suggest the answer is to add a file to /etc/sudoers.d/ with the values you want - and then (maybe?) as a user who should be able to 'sudo', use sed to delete the target line. (which will then fail if they're unable to - you can test a return code).