1

This is a tricky one. I understand to put NOPASSWD into the sudoers file to allow no passwords. But I'm trying to revert this and came across a server I have that has no trace of NOPASSWD anywhere. There are no files in /etc/sudoers.d either.

When I run sudo --list, I do see (root) NOPASSWD: ALL.

Running sudo -k still doesn't ask for a password. I cannot paste my exact sudoers file as it's on a separate network than this computer. So I will type everything not in comments:

Defaults   !visiblepw
Defaults   always_set_home
Defaults   match_group_by_gid
Defaults   always_query_group_plugins
Defaults   env_reset
Defaults   env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults   env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults   env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults   env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults   env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
Defaults   secure_path = /sbin:/bin:/usr/sbin:/usr/bin
root    ALL=(ALL)      ALL
%wheel  All=(ALL)      ALL

My guess is that something else is causing this as this isn't happening to more recent servers I have built.

I would guess if you were to use this configuration, you won't have any issues. Would any other program/package cause this, like sssd?

This is tied to IPA but there are no sudo rules tied to this server. My last resort to fix this would be to just rebuild the server, but I'd like to figure out what is causing this, if it's another program or just a bug.

3
  • 1
    Trust, but Verify. Trust your interpretation of the IPA sudo rules (that they don't apply to this machine), but verify it. Stop the client daemon that's using IPA (usually sssd) and see if the issue is still present. IPA's sudo rules can be pretty tricky to define, especially when you want to scope them to not affect some machines.
    – Sotto Voce
    Jun 16, 2023 at 10:27
  • 1
    @Sotto I stopped sssd and yes, it then would ask for the password, but with sssd stopped, inputting the password will deny sudo, including login access. And of course, the restart did not fix it either. You gave me an idea, so I'm going to check something out.
    – Gene
    Jun 16, 2023 at 12:28
  • 1
    @Sotto Figured it out. IPA does have a sudo rule tied to it. Made by a previous SA, it had a sudo option, !authenticate enabled, so that seemed to override the sudoers file. Either way, I thank you.
    – Gene
    Jun 16, 2023 at 13:12

1 Answer 1

1

Thanks to Sotto's comments, I checked IPA and turns out it did have a sudo rule created and !authenticate option was enabled which caused the no password. Thanks Sotto Voce.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .