3

I have a correctly working Debian server. All existing users who have been granted sudo rights can utilize sudo without any problems. However, a new user with a username that has a dot in it sees "Username is not in the sudoers file. This incident will be reported" when attempting to sudo.

I don't see any steps that were missed for this user. Here are my steps:

Create a privileged user with a dot in the username. I use this little script to add developer user accounts.

#!/bin/bash
uu=$1
useradd -m -G sudo,webdev -s /bin/bash $uu
passwd $uu
cd /home/$uu/
mkdir .ssh/
touch .ssh/authorized_keys
chmod 600 .ssh/authorized_keys
chmod 700 .ssh/
chown -R $uu:$uu .ssh/
ls -la .ssh/
cat $uu.pub > /home/$uu/.ssh/authorized_keys
echo "finished"

Check that user is in the sudo group:

getent group sudo

This already exists in /etc/sudoers

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Next I made /etc/sudoers.d/user.name (and set permissions to 640):

nano /etc/sudoers.d/user.name
user.name ALL=(ALL) NOPASSWD: ALL

To test, log in with the user account and try to sudo. I get the above error.

One way I was able to resolve this was by adding this user to a different group that has sudo rights.

Either I am missing something, or the dot in the username is causing a problem that is not experienced with the other usernames.

7
  • Were you already logged in as user.name before you added them to the group? You need to logout/login if you change groups. I just tried this on a Centos7 machine and it worked: -sh-4.2$ id -a uid=1000(test.user) gid=1000(sudo) groups=1000(sudo) -sh-4.2$ sudo id uid=0(root) gid=0(root) groups=0(root) . What Debian version are you using? Also be aware of any local caching of groups or similar. Jan 23, 2020 at 1:53
  • @StephenHarris - I made sure the user was logged out, then I tested with su user.name. Tested multiple times. Implented work-around, problem went away. Reverted my work-around, problem came back.
    – MountainX
    Jan 23, 2020 at 1:56
  • 9
    sudo.ws/man/1.8.15/… "sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character ..."
    – muru
    Jan 23, 2020 at 1:58
  • I just did an equivalent test on Debian 10 (Buster) $ id uid=2000(test.user) gid=2000(sudo) groups=2000(sudo) $ sudo id [sudo] password for test.user: uid=0(root) gid=0(root) groups=0(root) $ . Jan 23, 2020 at 2:00
  • 1
    @roaima True. But obviously I did not know that until user muru gave his comment above. That's the answer to my question. I'll accept it if muru posts it as an answer.
    – MountainX
    Jan 23, 2020 at 19:04

1 Answer 1

7

The solution was given in a comment by muru.

sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character ...

As roaima pointed out in another comment:

The dot in the username doesn't cause the issue. It's because you chose to put the sudo configuration in a file whose name contains a dot.

That was exactly the issue. And the solution, which I veriifed, was just:

sudo mv /etc/sudoers.d/user.name /etc/sudoers.d/username

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .