1

I'm in /etc which has the following the permissions:

drwxr-xr-x  23 root  wheel  2560 Jul  1 20:47 etc

$ whoami
pierre
$ groups
pierre

I have to run sudo if I want to touch foo in /etc.

What I want is to be prompted for root's password, but I don't get prompted, even after changing this line:

%wheel ALL=(ALL) NOPASSWD: ALL

in sudo visudo to:

%wheel ALL=(ALL) PASSWD: ALL

It shouldn't even matter though, considering my current user is not in group wheel... I've made sure that the root account has a password set (by setting it using sudo passwd root).

I'm on a FreeBSD 10.3-RELEASE-p11 cloud server.

Any insight on why I'm not getting prompted for a password is greatly appreciated!

Here is my suoders file after adding the line suggested in @jesse_b's answer.

## sudoers file.
##
## This file MUST be edited with the 'visudo' command as root.
## Failure to use 'visudo' may result in syntax or file permission errors
## that prevent sudo from running.
##
## See the sudoers man page for the details on how to write a sudoers file.
##

##
## Host alias specification
##
## Groups of machines. These may include host names (optionally with wildcards),
## IP addresses, network numbers or netgroups.
# Host_Alias    WEBSERVERS = www1, www2, www3

##
## User alias specification
##
## Groups of users.  These may consist of user names, uids, Unix groups,
## or netgroups.
# User_Alias    ADMINS = millert, dowdy, mikef

##
## Cmnd alias specification
##
## Groups of commands.  Often used to group related commands together.
# Cmnd_Alias    PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \
#               /usr/bin/pkill, /usr/bin/top
# Cmnd_Alias    REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff

##
## Defaults specification
##
## Uncomment if needed to preserve environmental variables related to the
## FreeBSD pkg utility and fetch.
# Defaults     env_keep += "PKG_CACHEDIR PKG_DBDIR FTP_PASSIVE_MODE"
##
## Additionally uncomment if needed to preserve environmental variables
## related to portupgrade
# Defaults     env_keep += "PORTSDIR PORTS_INDEX PORTS_DBDIR PACKAGES PKGTOOLS_CONF"
##
## You may wish to keep some of the following environment variables
## when running commands via sudo.
##
## Locale settings
# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
##
## Run X applications through sudo; HOME is used to find the
## .Xauthority file.  Note that other programs use HOME to find   
## configuration files and this may lead to privilege escalation!
# Defaults env_keep += "HOME"
##
## X11 resource path settings
# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
##
## Desktop path settings
# Defaults env_keep += "QTDIR KDEDIR"
##
## Allow sudo-run commands to inherit the callers' ConsoleKit session
# Defaults env_keep += "XDG_SESSION_COOKIE"
##
## Uncomment to enable special input methods.  Care should be taken as
## this may allow users to subvert the command being run via sudo.
# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
##
## Uncomment to use a hard-coded PATH instead of the user's to find commands
# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
##
## Uncomment to send mail if the user does not enter the correct password.
# Defaults mail_badpass
##
## Uncomment to enable logging of a command's output, except for
## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
# Defaults log_output
# Defaults!/usr/bin/sudoreplay !log_output
# Defaults!/usr/local/bin/sudoreplay !log_output
# Defaults!REBOOT !log_output

##
## Runas alias specification
##
Defaults rootpw
##
## User privilege specification
##
root ALL=(ALL) ALL

## Uncomment to allow members of group wheel to execute any command
# %wheel ALL=(ALL) ALL

## Same thing without a password
%wheel ALL=(ALL) PASSWD: ALL

## Uncomment to allow members of group sudo to execute any command
# %sudo ALL=(ALL) ALL

## Uncomment to allow any user to run sudo if they know the password
## of the user they are running the command as (root by default).
# Defaults targetpw  # Ask for the password of the target user
# ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'

## Read drop-in files from /usr/local/etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /usr/local/etc/sudoers.d
  • 2
    are there files in /usr/local/etc/sudoers.d ? – Jeff Schaller Jul 2 '17 at 2:04
  • You should be editing /usr/local/etc/sudoers. – arrowd Jul 2 '17 at 9:51
  • @Jeff... you hit the nail on the head :) Would you like to post an answer? – papiro Jul 3 '17 at 17:18
  • @arrowd, I checked /usr/local/etc/sudoers and verified that my edits via sudo visudo were indeed getting saved. – papiro Jul 3 '17 at 17:20
2

It's a non-obvious syntax, since it looks like a comment, but sudoers allows you to include rules in another directory with the directive:

#includedir /usr/local/etc/sudoers.d

It is likely that your nopasswd rule exists in a file in that directory.

|improve this answer|||||
0

Try adding the following line to /etc/sudoers:

Defaults rootpw

I think sudo normally prompts for that current user's password so long as the user is a member of the wheel group.

|improve this answer|||||
  • After reading about this in man sudoers, I added it thinking it would work. I also did a restart of the server - but no luck. I still am able to execute sudo touch foo without a password prompt. I also read in the man page the following: By default, sudo requires that a user authenticate him or herself before running a command. This behavior can be modified via the NOPASSWD tag. As my user isn't even part of any groups mentioned in the sudoers file, I would expect that the default would be as explained in the man page... :( – papiro Jul 2 '17 at 1:15
  • is it actually creating the file in /etc ? and if so what if you remove the file and try again? – jesse_b Jul 2 '17 at 1:32
  • Yes, it's creating foo, and i immediately do a sudo rm foo each time. I also double-verified by doing sudo vim foo and edited it and saved successfully. – papiro Jul 2 '17 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.