From owner-freebsd-questions@FreeBSD.ORG Sat Nov 24 03:31:26 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 80E4116A418 for ; Sat, 24 Nov 2007 03:31:26 +0000 (UTC) (envelope-from kamil.kisiel@gmail.com) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.183]) by mx1.freebsd.org (Postfix) with ESMTP id 7223013C43E for ; Sat, 24 Nov 2007 03:31:26 +0000 (UTC) (envelope-from kamil.kisiel@gmail.com) Received: by wa-out-1112.google.com with SMTP id k17so18358waf for ; Fri, 23 Nov 2007 19:31:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; bh=KE4gtm4wPg8Rlx4Ew78HLE5AuH9tl5bLzDqvuYBuYvw=; b=EWzKGxv1gFwsR1wMijxUT8ZwKHdot8oNjMJDk6nSm7LmL5dGCDME+S5RxC2AADOWoj3am7jElG6utcLCC35wvecj+4cmu5LSUiDIkA2EWeOYwKyCDumJeRxlq8oKNOg5A+wa3m6U3pWQogGhsH4ynHoA1tFzBzcazNJFIY8zj2Q= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=hcKWxgFtolGXJSCMrLIDDvh36S/KF3gcua7uqrv3AAEPt7Z6Dgor0ph8WPAWP61DoynjfhQSZEDNIYDILd87wwfXAtSYK6Zr6YjU4L/FtElsvJNKihfEJ/CTN0NEOryfzg9S6Ae1qAZ1gFqBtTjwX7Av+XALDfOckokBIveO3J0= Received: by 10.114.120.1 with SMTP id s1mr23680wac.1195875085772; Fri, 23 Nov 2007 19:31:25 -0800 (PST) Received: by 10.115.94.2 with HTTP; Fri, 23 Nov 2007 19:31:25 -0800 (PST) Message-ID: <66d392400711231931o498343cah71b61717546dc39c@mail.gmail.com> Date: Fri, 23 Nov 2007 19:31:25 -0800 From: "Kamil Kisiel" Sender: kamil.kisiel@gmail.com To: "Christopher Cowart" , freebsd-questions@freebsd.org In-Reply-To: <20071124031628.GI43532@hal.rescomp.berkeley.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <66d392400711231543x42aea684l3752bbbdcb65d2c5@mail.gmail.com> <20071124030410.GH43532@hal.rescomp.berkeley.edu> <66d392400711231909h42ca826la5d8818864a78a4e@mail.gmail.com> <20071124031628.GI43532@hal.rescomp.berkeley.edu> X-Google-Sender-Auth: c5cf80098532ecca Cc: Subject: Re: sudo never asks me for a password X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Nov 2007 03:31:26 -0000 On Nov 23, 2007 7:16 PM, Christopher Cowart wrote: > On Fri, Nov 23, 2007 at 07:09:36PM -0800, Kamil Kisiel wrote: > > On 11/23/07, Christopher Cowart wrote: > > > On Fri, Nov 23, 2007 at 03:43:39PM -0800, Kamil Kisiel wrote: > > > > For some reason, on this particular FreeBSD machine, sudo never asks > > > > me for a password, even if I haven't logged in for days. > > > > > > > > I've been struggling with this problem for some time but still haven't > > > > been able to find a solution. Any ideas? > > > > > > Maybe something is misconfigured in your pam stack? Check > > > /etc/pam.d/sudo. > > > > /etc/pam.d/sudo looks like this: > > > > # > > # $FreeBSD: src/etc/pam.d/su,v 1.16 2003/07/09 18:40:49 des Exp $ > > # > > # PAM configuration for the "su" service > > # > > > > # auth > > auth sufficient pam_rootok.so no_warn > > auth sufficient pam_self.so no_warn > > auth requisite pam_group.so no_warn > > group=wheel root_only fail_safe > > auth include system > > > > # account > > account include system > > > > # session > > session required pam_permit.so > > This looks like it was copied verbatim from su. > > I suspect the pam_self.so is causing problems. Sudo authenticates the > user for their current account, not the target account. That line will > cause authentication to short-circuit on a UID match w/o any need to > provide a password. Try commenting it out. > > -- > > Chris Cowart > Lead Systems Administrator > Network & Infrastructure Services, RSSP-IT > UC Berkeley > Thanks Christopher, That's exactly the problem. Seems the previous administrator of this machine made /etc/pam.d/sudo a link to /etc/pam.d/su and left it configured as is. Somehow I never caught on to that. -- Kamil