We are setting up a server with centos 6.10, when setting up a user with sudo, we discovered that sudo never asks for password. Setting up another user with the same (full) sudo rights, it is asked for password.
I have tried both to set up the users explicitely and to add it to the wheel group with the same behaviour. I have also set the password timeout to 0 with no changes.
[root@noaspare ~]# su mysql
bash-4.1$ ls -l ls:
cannot open directory.: Permission denied
bash-4.1$ sudo ls -l
[sudo] password for mysql: (Ctrl-C)
bash-4.1$ exit
[root@noaspare ~]# su ssi
[ssi@noaspare /root]$ ls
ls: cannot open directory .: Permission denied
[ssi@noaspare /root]$ sudo ls
anaconda-ks.cfg install.log install.log.syslog rpmbuild
sudo -l for the ssi gives:
Matching Defaults entries for ssi on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE
INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME > LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin,
timestamp_timeout=0
User ssi may run the following commands on this host:
Sudoers entry:
RunAsUsers: ALL
Commands:
ALL
Any idea why this configuration does not ask for a password? The only difference I can see between the two users is their shell, but I cannot see why that should matter.
The only line specific to the user is
ssi ALL=(ALL) ALL
NOPASSWDentry in your sudoers file(s). You can then link that config entry to the user account which works without prompting for a password.#includeor#includedir. Another thing to check is if the behaviour only occurs withsudo -lorsudo -v. If that's the case, you can check thelistpworverifypwoption. See the man page for details.