2

I've set up two VMs with exactly the same image (debian-11.3.0-amd64-netinst - headless).

The only things I touched on these machines are:

  • Root password
  • Sysad password
  • Installed sudo command
  • Changed IP addresses
  • Changed SSH Ports
  • Installed UFW, changed SSH Port and activated OpenSSH & WWW Full

On the machine I created first, everything works properly: I can SSH into it with the sysad user and then use su root followed by root password to gain root access (ssh root login disabled by default).

On the machine I created second (with the exact same image), I can SSH into it with the sysad user but su root throws me an "Authentication failure".

journalctl tells me basically the same thing:

pam_unix(su:auth): authentication failure...

I checked groups and uids for both systems and the configurations are exactly the same. Also, I am 100% sure of the password. Su + root password works when doing it on the machine directly (via the hypervisor). I also entered the password multiple times by hand, even tried to check for a false char-set by typing the password in the username field to see it in clear text.

Does anyone have an idea about what I am missing here?

4
  • Note that su root is pointless, it's exactly the same as su unless you have set up your system to have some other user as UID 0.
    – terdon
    Oct 24, 2022 at 17:21
  • "Authentication failure" usually means the wrong password. Are you 100% sure you are giving the correct password for the root account?
    – terdon
    Oct 24, 2022 at 17:22
  • Thanks for your replay terdon, the error shows also when doing su though.. Also i am 100% sure of the password. Su + root password works when doing it on the machine directly (via the hypervisor). I also entered the password multiple times by hand, even tried to check for a false char-set by typing the password in the username field to see it in clear text..
    – frostgod
    Oct 25, 2022 at 8:51
  • Do you have securetty or other tty based restrictions?
    – Joshua
    Aug 7, 2023 at 19:47

2 Answers 2

4

You mention you specifically installed sudo, but then you explain you use su to get root access. The two commands are not the same, although they achieve the same end result.

Either but not both:

sudo -s    # Ask for root access, usually authenticate with the caller's password
su         # Ask for root access, authenticate with the target's (root) password

Another possibility is that your source username is in the necessary group to be able to use one of these commands, but you need to log out and in again for it to be activated.

Check group memberships not just in /etc/group but also with the id command.

1
  • Thanks for your reply, I only wrote about sudo because I wanted to clarify what I did on the machines. I checked group memberships and they are exactly the same for both machines. (Otherwise I wouldn't be able to do su on the machine itself via the hypervisor. It must have something to do with SSH i believe..
    – frostgod
    Oct 25, 2022 at 12:16
-1

in addition to what was mentioned,

see /etc/sudoers by doing visudo and (at least in RHEL 7 with what I am familiar with) there is a %wheel line that requires users be a member of the wheel group in order to successfully su to root. I'm not sure at the moment going from memory how much this affects use of the sudo command preceding some other command.

You may also consider editing /etc/ssh/sshd_config and uncommenting and make PermitRootLogin YES that will facilitate access by allowing you to SSH between your VM's directly as root rather until you figure out your su and sudo setup.

xxx Generally nothing under /etc/pam.d if that is all default and unmodified should affect what you are doing (at least for what I am familiar with under RHEL, I assume the same is so with Debian) xxx

update: this is the default /etc/pam.d/su from RHEL 7.9

#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so use_uid

auth            substack        system-auth
auth            include         postlogin
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         include         postlogin
session         optional        pam_xauth.so

I was mistaken about saying nothing under /etc/pam.d. You'll want to check your /etc/pam.d/su file for starters; know there is also su-l and sudo and sudo-i in there at least in RHEL 7.9.

4
  • First paragraph. The sudoers file is nothing to do with su. Oct 24, 2022 at 20:07
  • Yes, sudoers affects sudo, including when running sudo command, but it does not in any way affect su. You can su to root if you know root's password, no other group membership or anything else needed.
    – terdon
    Oct 25, 2022 at 8:59
  • @terdon, i know for sure under a default RHEL 7.9 install from dvd if a user account is not in the wheel group then su will not allow that user to su to root. When I posted above I was going from memory, looking now I believe it is /etc/pam.d/su that has auth required pam_wheel.so use_uid is what causes that; i was mistaken about it being in /etc/sudoers
    – ron
    Oct 27, 2022 at 19:09
  • Thanks, @ron, looks like I was mistaken too then! I didn't know red hat shipped with that Pam setting. If you remove that part about sudores I'll change my downvote to an upvote.
    – terdon
    Oct 27, 2022 at 22:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .