OS: FreeBSD 12.1-Release-p10 Sudo: 1.9.5p2 Samba: 4.13.1_1
We've recently migrated to an Active Directory backend for DNS, DHCP, and in-house SSO support. I have SSH logins working well, using PAM to authenticate via the Samba/Winbindd setup. I want to control who can use sudo (just as root for now) via AD group memberships.
To that end, I created a new group in AD called "Unix Admins" that I would like sudo to check membership of, just like it does for local users and the wheel group. To that end I simply duplicated the existing wheel entry and have two group check lines as follows:
%wheel ALL=(ALL) ALL %Unix\ Admins ALL=(ALL) ALL
When an AD user who is not in either wheel or the new group logs in and tries to use sudo, they get the normal error about not being in the sudoers file, as expected. When they are in the AD group but not wheel, they are prompted for their password, and if they enter their password correctly the command executes as expected.
However, when they enter the wrong password, they are shown an error message that is a little cryptic given the situation, and then the command executes anyway as if they entered the correct password.
The error happens as follows:
% sudo ls Password: When trying to update a password, this return status indicates that the value provided as the current password is not correct. <<ls output here>>
Edit: Edited for clarity.
Edit2: /etc/pam.d & /usr/local/etc/pam.d relevant contents
# # $FreeBSD: branches/2021Q1/security/sudo/files/pam.conf 340872 2014-01-24 00:14:07Z mat $ # # PAM configuration for the "sudo" service # # auth auth include system # account account include system # session # XXX: pam_lastlog (used in system) causes users to appear as though # they are no longer logged in in system logs. session required pam_permit.so # password password include system
# # $FreeBSD: releng/12.1/lib/libpam/pam.d/system 197769 2009-10-05 09:28:54Z des $ # # System-wide defaults # # auth auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local #auth sufficient pam_krb5.so no_warn try_first_pass #auth sufficient pam_ssh.so no_warn try_first_pass auth sufficient pam_unix.so no_warn try_first_pass nullok auth sufficient pam_winbind.so try_first_pass # account #account required pam_krb5.so account required pam_login_access.so account required pam_unix.so # session #session optional pam_ssh.so want_agent session required pam_lastlog.so no_fail # password #password sufficient pam_krb5.so no_warn try_first_pass password required pam_unix.so no_warn try_first_pass