1

I have a correctly working Debian server. All existing users who have been granted sudo rights can utilize sudo without any problems. However, a new user with a username that has a dot in it sees "Username is not in the sudoers file. This incident will be reported" when attempting to sudo.

I don't see any steps that were missed for this user. Here are my steps:

Create a privileged user with a dot in the username. I use this little script to add developer user accounts.

#!/bin/bash
uu=$1
useradd -m -G sudo,webdev -s /bin/bash $uu
passwd $uu
cd /home/$uu/
mkdir .ssh/
touch .ssh/authorized_keys
chmod 600 .ssh/authorized_keys
chmod 700 .ssh/
chown -R $uu:$uu .ssh/
ls -la .ssh/
cat $uu.pub > /home/$uu/.ssh/authorized_keys
echo "finished"

Check that user is in the sudo group:

getent group sudo

This already exists in /etc/sudoers

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Next I made /etc/sudoers.d/user.name (and set permissions to 640):

nano /etc/sudoers.d/user.name
user.name ALL=(ALL) NOPASSWD: ALL

To test, log in with the user account and try to sudo. I get the above error.

One way I was able to resolve this was by adding this user to a different group that has sudo rights.

Either I am missing something, or the dot in the username is causing a problem that is not experienced with the other usernames.

Improve this question
  • Were you already logged in as user.name before you added them to the group? You need to logout/login if you change groups. I just tried this on a Centos7 machine and it worked: -sh-4.2$ id -a uid=1000(test.user) gid=1000(sudo) groups=1000(sudo) -sh-4.2$ sudo id uid=0(root) gid=0(root) groups=0(root) . What Debian version are you using? Also be aware of any local caching of groups or similar. – Stephen Harris Jan 23 '20 at 1:53
  • @StephenHarris - I made sure the user was logged out, then I tested with su user.name. Tested multiple times. Implented work-around, problem went away. Reverted my work-around, problem came back. – MountainX Jan 23 '20 at 1:56
  • 6
    sudo.ws/man/1.8.15/… "sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character ..." – muru Jan 23 '20 at 1:58
  • I just did an equivalent test on Debian 10 (Buster) $ id uid=2000(test.user) gid=2000(sudo) groups=2000(sudo) $ sudo id [sudo] password for test.user: uid=0(root) gid=0(root) groups=0(root) $ . – Stephen Harris Jan 23 '20 at 2:00
  • 1
    @roaima True. But obviously I did not know that until user muru gave his comment above. That's the answer to my question. I'll accept it if muru posts it as an answer. – MountainX Jan 23 '20 at 19:04
1

The solution was given in a comment by muru.

sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character ...

https://www.sudo.ws/man/1.8.15/sudoers.man.html#Including_other_files_from_within_sudoers

As roaima pointed out in another comment:

The dot in the username doesn't cause the issue. It's because you chose to put the sudo configuration in a file whose name contains a dot.

That was exactly the issue. And the solution, which I veriifed, was just:

sudo mv /etc/sudoers.d/user.name /etc/sudoers.d/username
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.