$ sudo some_command
Sorry, try again.
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts

This is what my shell prints when I enter a wrong password to a sudoed command.

Why could this happen?

$ sudo -V
Sudo version 1.6.7p5
$ uname -a
Linux lazer 2.6.18- #1 SMP Thu Sep 3 00:34:43 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
  • Can you post the result of sudo -V and uname -a?
    – l0b0
    Mar 14, 2011 at 13:10
  • what can probably also help is posting additional system details, distribution, version, specific things you may have done since installation...hth Mar 14, 2011 at 21:44
  • 1
    Don't have an answer yet, but +1 for finding a way to correctly use "thrice". Also, can you provide some info about your environment (Distro, version, etc.)? Mar 15, 2011 at 0:49

3 Answers 3


I was experimenting with the RSA SecurID modules in my PAM configuration a while back, and successfully created exactly this behavior for myself, so I know one way to replicate what you're seeing.

If you have a pam module that fails (returns PAM_AUTH_ERR) as either the only configured required module or as requisite before anything else (or in a number of other possible configurations with similar effect), it will instantly return failure to sudo, which will then try again, twice, getting three failures in quick succession. (You can configure passwd_tries in /etc/sudoers to a value other than 3 in order to get more or less failures, if for some reason you prefer.)

This doesn't prompt for your password once first, but there's definitely some PAM configurations which could do that, locking you out after the first failure and then returning failures quickly for the next tries.

So, I'm going to go ahead and guess that you've either messed up your PAM configuration, or else something pointed to by that configuration is failing (either correctly or not) in a way that doesn't introduce a delay. (The "normal" delay is usually actually introduced by the pam_unix.so module, unless you give it the nodelay argument.)

One easy way to recreate this is to put

auth       requisite      pam_deny.so

right above any existing auth lines in /etc/pam.d/sudo. Again, that's insta-failure, not prompt-once-and-then-fail, but this should put you on the track for your specific configuration. (As I understand it, your setup works fine if you give the right password, so I'd look into the on-failure behaviors of your configured PAM modules.)


this may be stupid, but is your keyboard working properly? you can be triple pressing the enter key.

something similar has happened to me :)

  • keyboards are fine!
    – Lazer
    Mar 14, 2011 at 16:13
  • beats me, then. sorry :\ Mar 14, 2011 at 21:43

Try sudo -K to remove the timestamp. Also have a look at the timestamps directory (/var/run/sudo on debian systems), maybe something went wrong there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .