Return
-
Title
Accounts without login access are no longer able to run sudo commands after upgrading to sudo 1.8.23 -
Description
A service account service account is unable to log directly into the system (denied through users.allow configuration), however users used to be able to access the account through su and then they were able to run additional commands through sudo.Since updating to sudo-1.8.23 (included with Red Hat and CentOS 7.6), the sudo command no longer works, it fails with the following message:sudo: PAM account management error: Permission deniedWhen the account is added to users.allow the sudo command works again, but the account shouldn't have direct login access. -
Cause
This is due to a recent change in sudo. Before allowing access to a user sudo will now perform an account check through PAM to verify that the account has access to the system. If the user doesn't have access then the sudo command will not be allowed. -
Resolution
This change can be worked around by disabling access checking for the pam_vas module. To do this, edit the sudo file in /etc/pam.d and append "no_access_check" to the first pam_vas line in the account section.
If the account settings are being included from another file, you will need to copy the account settings from this other file first.
-
Additional Information
More information about this change in the sudo command can be found here: https://access.redhat.com/solutions/3679241