-
Título
How to troubleshoot sudo not working? -
Descripción
How to troubleshoot sudo not working?
-
Resolución
Sudo must have been compiled with PAM support. Sudo must be configured properly to use PAM (/etc/pam.d/sudo or /etc/pam.conf). To configure sudo pam files you can use the command: 'vastool configure pam sudo' and 'vastool configure sudo'.
Sudoers file rules have to be setup correctly. If a group is configured in sudoers file then we must check that Authentication Services (QAS) knows the user is a member of that group.To check if the sudo group policy is apply if setup via VGP run /opt/quest/bin/vgptool rsop and look for the policy. If the sudo group policy is not apply,check the output of /opt/quest/bin/vgptool register command or the vgp.register.out file in the snapshot dataThis will list the currently registered extensions.Check if vgp_sudoext is listed.
Also useful is doing a ls -l /var/opt/quest/vgp and checking date on the extensions file to see if it was changed when the issue began.
Technical Support will need the following information to troubleshooting sudo issues:
1 - ldd `which sudo`
To check if sudo is compiled with PAM
2 - sudo -V
To check version of sudo
3 - sudo -L
4 - sudo -l5 - A copy of your sudoers file to check rules configured/etc/sudoers file or if using Privilege Manager /etc/opt/quest/qpm4u/policy/sudoers
6 - Login as the user account that you are trying to do sudo with and do the following:
7 - The output of 'id'
8 - The output of 'vastool -u host/ user getgroups USERNAME 'This will show if the user is member of a group in the sudoers file.9- If using Privilege Manager for Sudo, please check the following:The policy server status: /opt/quest/sbin/pmsrvcheck and /opt/quest/sbin/pmpolicy masterstatusThe status of the sudo plugin agent: /opt/quest/sbin/pmplugininfo10 - Go to the /opt/quest/libexec/vas/scripts directory and run the vas_snapshot.sh script. It will create vas_snapshot.(machine-name).tar.gz file in your /tmp directory. Please attach a copy of the vas_snapshot.(machine-name).tar.gz file to the support case. -
Información adicional
When multiple entries match for a user, they are applied inorder. Where there are multiple matches, the last match is used (which is not necessarily the most specific match) is the one that takes affect.
It is usually best to structure the sudoers file with the more general rules (e.g. sudo ALL) first and the more specific ones at the end.