0

On an Ubuntu 14.04 LTS system, I get a prompt of "Password for root" when logged in as a remote directory user (sssd). My user account is configured as a sudoer, both directly and via a group (from the directory):

fred:~$ sudo egrep -v '^(#|$)' /etc/sudoers
[sudo] password for brett:
...
%sudoers    ALL=(ALL) ALL
fred        ALL=(ALL) ALL
fred:~$ getent group | grep sudoers
sudoers:*:00000000:joe,fred,peter
fred:~$ getent passwd | grep fred
fred:*:00000:11111111:Fred:/home/fred

Both passwd and group come from the directory (kerberos). I am able to sudo in console, but the UI prompts for root passwd (root has no password, which I'd like to keep that way) - on other systems, I've always been prompted for my own password, for sudo things in the background.

gksu was previously not installed, not sure if this is required, but have installed it and am still getting the same thing.

Is is possible to configure GUI to prompt for current user password instead of root password if current user is a sudoer?

edit 1 It seems that polkit is also involved in this. I tried changing the "sudoers" group name in the remote directory to "sudo", but not sure if having 2 groups with the same name but different ids is a great idea. I've added sudoers group to AdminIdentities by editing /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf. There was no immediate success, but am rebooting now to see if it fixes it.

1 Answer 1

0

Add a user as a sudoer is not enough for the GUI - the user / group also needs to be configured as an admin in polkit. For example, if you want to allow all members of the non-standard / custom sudocustom group to run sudo graphically, assuming they're configured as sudoers, you could modify /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf from:

AdminIdentities=unix-group:sudo;unix-group:admin

to

AdminIdentities=unix-group:sudo;unix-group:admin;unix-group:sudocustom

This should give you a selection of users from the list of groups to elevate as (i.e. all members of sudo, admin and sudoers above).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.