2

I have two servers running the same version of RedHat 6.4, however one of them behaves differently when I run remote sudo commands through SSH on it. On server1, the connection is automatically closed after a successful sudo command, but on server3, the connection is kept open.

Note that for these tests the sudo user had the NOPASSWD flag so no prompt is asked. As far as I know, all configurations on these servers are the same (they were cloned).

I tested using this:

ssh -vvv user@server1 << EOF
sudo ls -l /home/
ls -l /home/
pwd
EOF

If I run this on server1 I get a single file listing.

debug3: Wrote 32 bytes for a total of 1621
total 40
drwxr-xr-x.  5 user       user       4096 Apr 26  2013 user
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain

Running without the sudo command on the same server I get my two file listing and the pwd result

ssh -vvv user@server1 << EOF
ls -l /home/
ls -l /home/
pwd
EOF

Result:

debug3: Wrote 32 bytes for a total of 1605
total 40
drwxr-xr-x.  5 user       user       4096 Apr 26  2013 user
total 40
drwxr-xr-x.  5 user       user       4096 Apr 26  2013 user
/home/user
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain

However, running the script with the sudo command on server3 I get the result of all 3 commands like the previous test. I compared the output of the ssh -vvv logs from both servers (1 and 3) and everything seems the same except for a debug line in a different order when the connection is closed (see client_input... line).

server1 (same with or without sudo)

[command results]
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain
debug2: channel 0: obuf empty
debug2: channel 0: close_write
debug2: channel 0: output drain -> closed
debug2: channel 0: rcvd close

server3

[command results]
debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain
debug2: channel 0: obuf empty
debug2: channel 0: close_write
debug2: channel 0: output drain -> closed
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug2: channel 0: rcvd close

I would like to know how to fix server1 so that the connection isn't automatically closed so that my script can execute completely when including sudo commands.

Some options I already checked:

  • SE Linux is disabled
  • The passwd file is properly configured with the /bin/bash shell
  • errexit is off (command is successful anyway)
  • sudoers and sshd_config configuration is the same between the two servers

The only difference between the servers I see is that the buggy server1 is an older generation of server, it's a ProLiant DL380 G7 compared to a G8 for server3. Other servers I've tried and that are working are also G8 (I only have one G7 to try on). I don't see how the hardware can cause that type of issue.

  • I wonder if errexit is being set? – Jeff Schaller Dec 18 '18 at 15:41
  • 1
    also, compare the /etc/sudoers files (including /etc/sudoers.d/*), keeping an eye out for any requiretty or !requiretty differences. Perhaps server3 has been configured to allow sudo without requiring a tty, and server1 has not. One way to test would be to modify the server 1 command from ssh -vvv user@server1 ... to ssh -t -vvv user@server1.... The -t option will force the allocation of a tty. If sudo works doing that, then it's a tty requirement stuffing you up. – Tim Kennedy Dec 18 '18 at 15:44
  • errexit is off (command is successful anyway). requiretty is commented out in the sudoers file and sudoers.d directory is empty. – Bibz Dec 18 '18 at 15:53
  • I tried adding the ssh -t ... and I have the same issue. – Bibz Dec 20 '18 at 14:13
  • sshd_config files are identical between servers. The user has a shell in passwd. sudoers configuration is the same between the servers. – Bibz Jan 7 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.