-
Title
Sudo is rejecting passwords without user intervention. Sudo not working. -
Description
Receiving the following after issuing sudo command:
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
Sorry, try again.
sudo: 3 incorrect password attempts -
Cause
CAUSE1: The PAM configuration for sudo is missing or incorrect.
CAUSE2: Sudo file configuration.
-
Resolution
RESOLUTION 1:
1. Run the command "/opt/quest/bin/vastool configure pam sudo" to set up sudo.
2. If there is a pam.deny entry in the sudo PAM stack edit the /etc/pam.d/sudo or (/etc/pam.conf) file and comment the pam_deny.so module out like below:
#auth required /lib/security/$ISA/pam_deny.so
auth sufficient pam_vas3.so create_homedir get_nonvas_pass
store_creds
auth requisite pam_vas3.so echo_return
#account required /lib/security/$ISA/pam_deny.so
account sufficient pam_vas3.so
account requisite pam_vas3.so echo_return
#password required /lib/security/$ISA/pam_deny.so
password sufficient pam_vas3.so
password requisite pam_vas3.so echo_return
#session required /lib/security/$ISA/pam_deny.so
session required pam_vas3.so create_homedir
session requisite pam_vas3.so echo_returnRESOLUTION 2:vastool configure sudo will configure sudo to allow access control based on Active Directory groups that are not Unix-enabled. The location of the configuration file (sudoers file) will be determined automatically if visudo is in your PATH. Alternatively you can provide the path to visudo with the -V option, or the path to a sudoers filewith the -f option.See sudo_vas(8) for more information on the Sudo add-on features provided by QAS.EXAMPLES:vastool configure sudovastool configure sudo -V /usr/sbin/visudovastool configure sudo -f /etc/sudoers1. /opt/quest/bin/vastool configure sudo -
Additional Information
On AIX systems that are using Privilege Manager for Sudo, sudo needs to be configured in PAM using the above vastool command even if the system is using LAM by default. Privilege Manager for Sudo only supports using PAM and so it will not work without that configured.