0

Sudo in Debian 10 is driving me mad. I have a clean, vanilla install of Debian 10. During installation, I've set a root password as well as created a normal user, let's name him "tom".

Logged in as Tom, I open a terminal and try to add tom to sudo:

su  
[entering root password]  
whoami  
[root]  
/usr/sbin/usermod -a -G sudo tom  

No errors, all seems well. Testing it:

su tom  
whoami  
[tom]  
sudo echo "hello";  
[hello]  

Works as expected. Next, I close the terminal. Still logged in as Tom in this desktop session, I open a new terminal:

sudo echo "hello";  
[error: tom is not sudoers file]  

The sudo add is not persisted, as soon as I close a terminal, it's gone. I can confirm this with the "groups" command. After the above sequence of commands, it successfully lists "tom" as part of the sudo group. After closing the terminal and opening a new terminal, "groups" shows "tom" as not part of the sudo group.

Why is my change not persisted?

(on a probably unrelated note, I'm unable to visually log into the system using my root account, despite knowing sure the password is correct).

2
  • 2
    The graphic session may require a restart to update group preferences. Have you tried logging out from the desktop manager and then logging in again? – giusti Feb 5 '20 at 22:14
  • @giusti Yes, tried that, makes no difference. – Fer Feb 5 '20 at 22:23
7

Your change is being persisted, and you can verify that by running

grep sudo /etc/group

which should show tom as a member of group sudo.

What is happening is that your user’s groups aren’t being reloaded. When you run su, you effectively log in again, and the resulting shell is set up with tom as a member of group sudo. But your desktop session isn’t, and won’t be until you log out and log back in again, or perhaps not even then (if your systemd user session persists, for example).

5
  • Thanks, now I'm even more confused. Starting fresh (logging out and in), I can confirm the grep outputs tom. yet the command "groups" does not show sudo. Also, sudo itself does not work, it still mentions tom is not in the sudoers file. This was a fresh session without any su switch. – Fer Feb 5 '20 at 22:22
  • Update: interestingly, a full system reboot solved it. The Logout option in the GUI is not enough to reload groups, it seemingly needs a full system restart. Weird? – Fer Feb 5 '20 at 22:29
  • I think something is caching your group membership like /lib/systemd/systemd --user – Stefan Skoglund Feb 6 '20 at 0:54
  • When you open a new window you are not logging in again, and you're just opening a new window in the current session. That means it inherits the groups you were in when you first started the window session. You need to logout of the whole windows session and login again to get it to pick up the group changes. Now, depending on your environment, you may have cached data (eg nscd or sssd or similar) which may need flushing. Or, as you found, rebooting... which flushed the cache and forced you to login again! – Stephen Harris Feb 6 '20 at 1:16
  • @StephenHarrisI wasn't just opening a new window, I logged out of the desktop session completely. Strangely not even that was enough, indeed probably some cache. – Fer Feb 6 '20 at 9:07
1

You need to log out and in again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.