1

I'm seeking for kind of old style solution: I need to cause all elevated priviledges platform on Ubuntu machine to request target user/root password instead of asking for calling user password.

I've managed to set target user setting for sudo, still, applications using the Polkit for extended priviledges are requesting the user password by default.

I've seen multiple users of other distros seeking opposite solution, to let Polkit use user password instead of root password, still no clear answer is achieved!

Any assistanse is highly appreciated!

  • 1
    I think it's just a matter of overriding the 51-ubuntu-admin.conf file - or, rather, preventing it from overriding the package default 50-localauthority.conf in which AdminIdentities is defined as unix-user:0. I'm not sure the right way to do that - renaming 51-ubuntu-admin.conf to 51-ubuntu-admin.conf.old seems to work, but so should re-numbering it < 50 so the 50- file takes precedence. It's possible that either or both methods are susceptible to being overwritten by subsequent package updates though - idk. See man pklocalauthority. – steeldriver Dec 27 '19 at 23:39
  • @steeldriver Please consider turning your comment to an answer. it seems to work for others who can then up-vote your answer. – user68186 Jun 3 at 23:38
  • 1
    @user68186 thanks for the reminder - done – steeldriver Jun 4 at 0:18
3

This behavior is controlled by PolicyKit's LocalAuthority configuration. From the ADMINISTRATOR AUTHENTICATION section of man pklocalauthority:

   By default, "administrator authentication" is defined as asking for the
   root password. Since some systems, for usability reasons, don't have a
   root password and instead rely on a group of users being member of an
   administrative group that gives them super-user privileges, the Local
   Authority can be configured to support this use-case as well.

   Configuration for the Local Authority is read from files in the
   /etc/polkit-1/localauthority.conf.d directory. All files are read in
   lexigraphical order (using the C locale) meaning that later files can
   override earlier ones. The file 50-localauthority.conf contains the
   settings provided by the OS vendor. Users and 3rd party packages can
   drop configuration files with a priority higher than 60 to change the
   defaults.

At least in my (18.04) Ubuntu system, the two relevant files are 50-localauthority.conf and 51-ubuntu-admin.conf:

$ head /etc/polkit-1/localauthority.conf.d/*
==> /etc/polkit-1/localauthority.conf.d/50-localauthority.conf <==
# Configuration file for the PolicyKit Local Authority.
#
# DO NOT EDIT THIS FILE, it will be overwritten on update.
#
# See the pklocalauthority(8) man page for more information
# about configuring the Local Authority.
#

[Configuration]
AdminIdentities=unix-user:0

==> /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf <==
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

So, in order to revert to the PolicyKit default, which uses AdminIdentities=unix-user:0 (i.e. root) instead of the Ubuntu default AdminIdentities=unix-group:sudo;unix-group:admin (i.e. members of sudo and/or admin groups), it's sufficient to either rename the 51-ubuntu-admin.conf file so that it is loaded earlier or not at all - for example

sudo mv /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf{,.ignore}

or comment out the AdminIdentities entry therein. The former option is perhaps cleaner and more maintainable.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.