3

When I try to sudo something I get: " luke is not in the sudoers file. This incident will be reported."

All sudo users have failure in the same way.

How can I get more detailed information about what exactly is failing here? This used to work fine, but somebody else with sudo access has messed around (?) and now sudo doesn't work (although I can su to root and sudo from there fine.)

I've checked /etc/sudoers (contents and permissions all match my default install, visudo -c reports all is OK)

I am definitely still in the sudo group:

$ getent group sudo
sudo:x:27:luke,user2,user3

When I add

 luke    ALL=(ALL:ALL) ALL

to /etc/sudoers it does let me use sudo. but why can't members of the sudo group use it?

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
sudo    ALL=(ALL:ALL) ALL

luke    ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

ubuntu 16.04 server edition.

  • The default way that Ubuntu gives sudo rights to users is to make them members of the sudo group (or, historically, the admin group). Perhaps it is the group membership that got messed up, rather than the sudoers configuration? what is the output of getent group sudo for example? – steeldriver Jun 1 at 17:04
  • 1
    It sounds like you should ask that "somebody with sudo access" what exactly they did while they were messing around... – Jeff Schaller Jun 1 at 17:32
3
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
sudo    ALL=(ALL:ALL) ALL

The line after the comment Members of the admin group may gain root privileges grants sudo access to member of the group admin, but the line after Allow members of group sudo... has the % sign removed from the beginning, and so it only grants sudo access to a user named sudo, not to a group with the same name.

| improve this answer | |
  • nailed it. thanks so much! – ezekiel Jun 2 at 9:43
0

The simplest thing to do is to add user luke :

visudo

then

luke   ALL=(ALL:ALL) ALL 
| improve this answer | |
  • this does let me use sudo again, so was definitely a useful shout. I'd really like to work out what the underlying problem is and fix it, but I'll accept in a couple days if I give up and just use this workaround indefinitely. – ezekiel Jun 1 at 22:40
0

Causes
A broken sudo may be caused by any of the following:

  1. A user should not have been removed from the sudo or admin group.
  2. The /etc/sudoers file was altered to prevent users in sudo or admin group from elevating their privileges to that of root using sudo command.
  3. The permission on /etc/sudoers file is not set to 0440.


Follow the steps below to fix it.

  1. Open a terminal window,
  2. Enter root using command su root
  3. Input root password
  4. Input command apt-get install sudo -y to install sudo
  5. Add user to sudoers file by inputting adduser username for a new user or usermod -aG sudo username for existing user. Put your username in place of username.

    You can use usermod -aG sudo,adm username to add it to both sudoers and admin groupt.

  6. Set the correct permissions for sudoers file by inputting chmod 0440 /etc/sudoers
  7. Type exit and hit Enter until you close your terminal window.
  8. Shutdown your system completely and reboot.
  9. Open another terminal window.
  10. Try any sudo command to check if your username is correctly added to sudoers file. e.g

    sudo apt-get update

    If your username has been correctly added to the sudoers list then you will not get the error.

| improve this answer | |
  • 1
    thanks for the detailed answer. turned out a small corruption in the "sudo ALL=(ALL:ALL) ALL" line was the underlying problem – ezekiel Jun 2 at 9:48
  • You're welcome. – David Kariuki Jun 2 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.