Setting NOPASSWD for a user still promts for a password

Question

I am trying to set up an ansible user following a tutorial. They set NOPASSWD to ALL for the ansible user, which allowed them to -become root whenever they needed with no password involved.

I tried to do the same and am long unable to get the same result. Running CentOS 8, the following lines from visudo file:

## Same thing without a password
%wheel          ALL=(ALL)       NOPASSWD: ALL
ansible         ALL=(ALL)       NOPASSWD: ALL
cloud_user      ALL=(ALL)       NOPASSWD: ALL

I'm using cloud_user for login since root login is restricted, but I still need root to install software through ansible. I surfed the internet about the order of the users in the list, but as you can see the cloud_user is the last one and is never mentioned again in the file. I assume that should allow me to use root on it without password.

The issue is that cloud_user is still prompted for password in sudo commands, and ansible says "Missing sudo password".

sudo -ll output:

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Options: !authenticate
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

Sudoers entry:
    RunAsUsers: ALL
    Commands:
        ALL

sudo -l -U cloud_user output:

Matching Defaults entries for cloud_user on [host name]:
    !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY
    HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
    LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User cloud_user may run the following commands on [host name]:
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL
    (ALL) ALL

sudo cat /var/log/secure | grep cloud_user output:

Aug 27 13:23:11 localhost sshd[6222]: pam_unix(sshd:session): session opened for user cloud_user by (uid=0)
Aug 27 13:23:40 localhost sudo[6270]: cloud_user : TTY=pts/0 ; PWD=/home/cloud_user ; USER=root ; COMMAND=/bin/ls /root
Aug 27 13:23:40 localhost sudo[6270]: pam_unix(sudo:session): session opened for user root by cloud_user(uid=0)
Aug 27 13:24:03 localhost sudo[6291]: cloud_user : TTY=pts/0 ; PWD=/home/cloud_user ; USER=root ; COMMAND=/bin/cat /var/log/secure
Aug 27 13:24:03 localhost sudo[6291]: pam_unix(sudo:session): session opened for user root by cloud_user(uid=0)

Answer 1

If multiple configuration lines match to the cloud_user and the command requested, then the last line wins. The line in /etc/sudoers.d/90-cloud-init-users that matches cloud_user without NOPASSWD is overriding your line that includes the NOPASSWD.

The contents of /etc/sudoers.d are included in the main sudoers configuration at the point of the #includedir /etc/sudoers.d or @includedir /etc/sudoers.d directive (correct syntax depends on version of sudo). The ordering of the configuration lines is important: you could, in turn, use visudo -f /etc/sudoers.d/91-my-customizations to add your sudoers lines to take effect after the ones made by cloud-init.

Also, check /etc/sudo.conf for possible plug-ins or alternative configuration sources. A cloud provider may have added some customizations of their own to make sure their automation will always be able to do its jobs.