30

Following the instruction here I get:

pkexec visudo

==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/usr/sbin/visudo' as the super user
Authenticating as: Thomas,,, (tuc) Password:  polkit-agent-helper-1:
error response to PolicyKit daemon:
GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for
cookie
==== AUTHENTICATION FAILED === 
Error executing command as another user: Not authorized

This incident has been reported.

I am doing this via ssh since the box I am doing this on is used as a music server with no screen and is rather inaccessible. This happened when I upgraded from Ubuntu 14.04 to 16.04. I tried to copy a sudoers file from another recent 16.04 installation, but I can't do that because of the sudoers file:

sudo mv ~/gyrf sudoers

>> /etc/sudoers: syntax error near line 36 <<<
>> /etc/sudoers: syntax error near line 37 <<<
>> /etc/sudoers: syntax error near line 38 <<<
>> /etc/sudoers: syntax error near line 39 <<<
>> /etc/sudoers: syntax error near line 40 <<<
>> /etc/sudoers: syntax error near line 41 <<<
>> /etc/sudoers: syntax error near line 42 <<<
>> /etc/sudoers: syntax error near line 43 <<<
>> /etc/sudoers: syntax error near line 44 <<<
>> /etc/sudoers: syntax error near line 45 <<<
>> /etc/sudoers: syntax error near line 46 <<<
>> /etc/sudoers: syntax error near line 47 <<<
>> /etc/sudoers: syntax error near line 48 <<<
>> /etc/sudoers: syntax error near line 49 <<< 
sudo: parse error in /etc/sudoers near line 36    
sudo: no valid sudoers sources found, quitting sudo: unable to initialize policy plugin

Should I go get the box from the attic and try pkexec visudo or is something else wrong here?

3
  • AFAIK pkexec only allows this for a local user (not an SSH remote user) - so yes it should work from the attic Jul 17 '16 at 11:29
  • Either get the box, or get the drive, mount it in another computer and edit sudoers to suit. Depends on whats easiest.
    – vidarlo
    Jun 19 '18 at 23:27
  • @steeldriverIt It just worked to me as a remote user. JFYI.
    – php-coder
    Feb 6 '19 at 16:47
73

I ran into this problem also and with some digging, found a working solution. The original solution is from this github issue for NixOS by EstalillaJ.

  1. Open two ssh sessions to the target server.

  2. In the first session, get the PID of bash by running:

    echo $$

  3. In the second session, start the authentication agent with:

    pkttyagent --process (pid from step 2)

  4. Back in the first session, run:

    pkexec visudo

  5. In the second session, you will get the password prompt. visudo will start in the first session.

14
  • 9
    Holy shit dude, u saved my life! thx :D Jul 31 '18 at 22:01
  • 1
    that is crazy, it works perfect! and no need to reboot the system Oct 16 '18 at 18:02
  • 1
    Thanks a ton, this really saved me! ⭑
    – Frederic
    Jul 13 '19 at 6:36
  • 3
    I didn't understand why it worked, but it worked.
    – FarO
    Mar 2 '20 at 16:28
  • 3
    I'm super glad this is helping you all out. I was just as thrilled when I found that original answer! @Long, from my understanding pkexec is similar to sudo in allowing you to escalate to root permissions. Depending on the implementation it will look for a different group on the user (wheel, sudo, etc). Since the sudoers file is corrupt, sudo cannot check if the user has permissions to escalate privs. I think the two SSH sessions is just a quirk of how pkexec was designed. I mainly see it on Desktop Environments as the password prompt
    – Satyen A.
    Jul 16 '21 at 6:48
2

My answer based on Satyen's

It was tested on Debian 10.4 WITHOUT ability to run visudo

  1. Open two ssh sessions to the target server.

  2. In the first session, get the PID of bash by running:

    echo $$

  3. In the second session, start the authentication agent with:

    pkttyagent --process (pid from step 2)

  4. Back in the first session, run:

    pkexec su

  5. In the second session, you will get the password prompt. su will start in the first session.

  6. Edit /etc/sudoers by (CTRL+S to save edits, CTRL+X to exit)

    nano /etc/sudoers

Not the answer you're looking for? Browse other questions tagged or ask your own question.