User in admin group still being prompted for password to sudo

Question

I'm trying to script the creation of a user with sudo access for my ec2 instances.

I'm having problems setting up sudo access. I'm running the following as root...

adduser --disabled-password --gecos "" testuser
usermod -a -G admin,sudo testuser

I then copy the authorized_keys from s3.

The ssh works fine at this point.

However if I try to sudo, I'm prompted for a password.

My sudoers file includes the following...

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Apart from logging out and logging back in, is there anything I need to do to actually make my changes take effect?

I didn't change the sudoers file, this was the default setup.

Also there's another system created user ubuntu, which can sudo successfully. However there is no explicit mention of this user in the sudoers file, so it must be doing it through group membership.

update: I tried adding every other group that "ubuntu" belongs to testuser, but I'm still being prompted for the password.

Is there any way I can figure out how "ubuntu" gets passwordless sudo access?

Answer 1

You will always be prompted for a password unless you have the NOPASSWD option set in the sudoers file for any given entry (ignoring the grace period the password is remembered and hence not prompted, default 15 minutes).

For example, to make all members of the sudo group to have passwordless sudo implementation:

%sudo   ALL=(ALL:ALL) NOPASSWD: ALL 

This indicates any member of the sudo group can run any command starting with sudo without prompting for password.

Similarly for user foobar to run the command reboot:

foobar ALL=(ALL:ALL) NOPASSWD: /sbin/reboot

Note that, it is not a good idea to have passwordless sudo access for all commands unless you have a very good reason, you should consider restricting the commands to a necessary minimum.

---

The sudo rules can also be defined in files under the /etc/sudoers.d/ directory, default /etc/sudoers file contains:

includedir /etc/sudoers.d

at the end, this makes any file that does not contain . or ends in ~ to be read for sudo rules. Presumably the definitions for user ubuntu defined in any of the files under the /etc/sudoes.d/ directory.

Answer 2

I had the same issue, on an AWS EC2 instance. Turns out that cloud-init adds a file in /etc/sudoers.d 90-cloud-init-users with these contents:

# Created by cloud-init v. 19.2-36-g059d049c-0ubuntu2~18.04.1 on Wed, 05 Jan 2022 09:44:40 +0000

# User rules for ubuntu
ubuntu ALL=(ALL) NOPASSWD:ALL

Adding the same line for my user solved the issue.

Since you mentioned S3 i guess this is your issue, combined with the behaviour of the sudoers config file: " When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).", see man sudo.