1

At work I have Ubuntu 16.04 with LDAP account. I have several NOPASSWD rules in /etc/sudoers.d/gbs configured. They are visible:

$ sudo -l
Matching Defaults entries for m.lewicki on AMDC1494.digital.local:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, timestamp_timeout=120, env_keep+=http_proxy, env_keep+=no_proxy, env_keep+=https_proxy, env_keep+=HTTP_PROXY, env_keep+=HTTPS_PROXY,
    env_keep+=BUILD_DIR

User m.lewicki may run the following commands on AMDC1494.digital.local:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: /bin/mount -o bind /*/* */scratch.*
    (ALL) NOPASSWD: /bin/umount -l */scratch.*
    (ALL) NOPASSWD: /bin/umount -l -f */scratch.*
    (ALL) NOPASSWD: /bin/mkdir -p */scratch.*
    (ALL) NOPASSWD: /usr/bin/build
    (ALL) NOPASSWD: /bin/cp *.conf */scratch.*/*.conf
    (ALL) NOPASSWD: /bin/rm -f */.build.log
    (ALL) NOPASSWD: /bin/echo -n
    (ALL) NOPASSWD: /usr/sbin/chroot */scratch.*
    (ALL) NOPASSWD: /usr/bin/chroot */scratch.*
    (root) NOEXEC: NOPASSWD: /usr/bin/updatedb
    (ALL) ALL

However they are ginored. For example

$ sudo echo -n

Still asks for password. I tried adding "sudoers: files ldap" to vim /etc/nsswitch.conf and tried apt-get install sudo-ldap, but neither helped.

Local user account that is NOT managed by LDAP works fine and doesn't ask for password for specified commands.

How to make local sudoers file respected?

  • 1
    If you run sudo -l /bin/echo -n, what happens? – muru Dec 5 '16 at 14:24
  • $ sudo -l /bin/echo -n gives /bin/echo -n and does not ask for password – MateuszL Dec 5 '16 at 14:43
1

There is a known issue in the version of sudo that ships with 16.04. While this did not fix my issue, it's a good place to start. I included some other possible causes in this Unix & Linux answer. I'm actually still troubleshooting and will document any additional findings there.

  • Welcome to the site and thank you for your input. This is more of a follow on comment, not an answer. Next time please add text like this as a comment. – Phil UK Apr 21 '17 at 5:27
  • Not new to SE just Ask Ubuntu. Comments require 50 rep. – claytond Apr 21 '17 at 18:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.