Why can't I su to root via ssh?

Question

I've set up two VMs with exactly the same image (debian-11.3.0-amd64-netinst - headless).

The only things I touched on these machines are:

• Root password
• Sysad password
• Installed sudo command
• Changed IP addresses
• Changed SSH Ports
• Installed UFW, changed SSH Port and activated OpenSSH & WWW Full

On the machine I created first, everything works properly: I can SSH into it with the sysad user and then use su root followed by root password to gain root access (ssh root login disabled by default).

On the machine I created second (with the exact same image), I can SSH into it with the sysad user but su root throws me an "Authentication failure".

journalctl tells me basically the same thing:

pam_unix(su:auth): authentication failure...

I checked groups and uids for both systems and the configurations are exactly the same. Also, I am 100% sure of the password. Su + root password works when doing it on the machine directly (via the hypervisor). I also entered the password multiple times by hand, even tried to check for a false char-set by typing the password in the username field to see it in clear text.

Does anyone have an idea about what I am missing here?

Answer 1

You mention you specifically installed sudo, but then you explain you use su to get root access. The two commands are not the same, although they achieve the same end result.

Either but not both:

sudo -s    # Ask for root access, usually authenticate with the caller's password
su         # Ask for root access, authenticate with the target's (root) password

Another possibility is that your source username is in the necessary group to be able to use one of these commands, but you need to log out and in again for it to be activated.

Check group memberships not just in /etc/group but also with the id command.

Answer 2

in addition to what was mentioned,

see /etc/sudoers by doing visudo and (at least in RHEL 7 with what I am familiar with) there is a %wheel line that requires users be a member of the wheel group in order to successfully su to root. I'm not sure at the moment going from memory how much this affects use of the sudo command preceding some other command.

You may also consider editing /etc/ssh/sshd_config and uncommenting and make PermitRootLogin YES that will facilitate access by allowing you to SSH between your VM's directly as root rather until you figure out your su and sudo setup.

xxx Generally nothing under /etc/pam.d if that is all default and unmodified should affect what you are doing (at least for what I am familiar with under RHEL, I assume the same is so with Debian) xxx

update: this is the default /etc/pam.d/su from RHEL 7.9

#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so use_uid

auth            substack        system-auth
auth            include         postlogin
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         include         postlogin
session         optional        pam_xauth.so

I was mistaken about saying nothing under /etc/pam.d. You'll want to check your /etc/pam.d/su file for starters; know there is also su-l and sudo and sudo-i in there at least in RHEL 7.9.