I broke Sudo after an upgrade from 9 to 12.04.1
Currently sudo will prompt for a password, but absolutely nothing happens after that. No errors of any kind.
I've checked the sudoers file, it passed the visudo syntax check, here's the setup:
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
The file has 0440 as permission. I've added myself to the sudo and admin group.
Here's what it looks like when I attempt to use Sudo:
kml@rhythmsdev:/etc$ sudo apt-get update
kml@rhythmsdev:/etc$
As you can see, no error at all. It simply returns to the prompt.
Here's the file permissions
-r--r----- 1 root root 723 Feb 1 10:10 sudoers
sudoers.d
drwxr-xr-x 2 root root 4096 Feb 4 16:46 .
Here is the output of id one of the Users that I'm trying to get Sudo to work under:
uid=1010(kml) gid=102(develop) groups=102(develop),4(adm),27(sudo),106(admin),110(ftp)
How I performed the upgrade.
I performed the upgrade using do-release-upgrade -d over SSH, but with physical access possible via a trip down the hallway.
Here are the contents of the /etc/sources.list
#
# deb cdrom:[Ubuntu-Server 10.04 LTS _Lucid Lynx_ - Release i386 (20100427)]/ lucid main restricted
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main restricted
## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise universe
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
## Uncomment the following two lines to add software from the 'backports'
## repository.
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb http://us.archive.ubuntu.com/ubuntu/ lucid-backports main restricted universe multiverse
# deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-backports main restricted universe multiverse
## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu lucid partner
# deb-src http://archive.canonical.com/ubuntu lucid partner
deb http://security.ubuntu.com/ubuntu precise-security main restricted
deb-src http://security.ubuntu.com/ubuntu precise-security main restricted
deb http://security.ubuntu.com/ubuntu precise-security universe
deb-src http://security.ubuntu.com/ubuntu precise-security universe
deb http://security.ubuntu.com/ubuntu precise-security multiverse
deb-src http://security.ubuntu.com/ubuntu precise-security multiverse
# deb http://security.ubuntu.com/ubuntu maverick-security main universe
Directory: /etc/apt/sources.list.d is empty.
lsb_release -a is
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 12.04.1 LTS
Release: 12.04
Codename: precise
apt-cache policy sudo is:
sudo:
Installed: 1.8.3p1-1ubuntu3.3
Candidate: 1.8.3p1-1ubuntu3.3
Version table:
*** 1.8.3p1-1ubuntu3.3 0
500 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main i386 Packages
100 /var/lib/dpkg/status
1.8.3p1-1ubuntu3.2 0
500 http://security.ubuntu.com/ubuntu/ precise-security/main i386 Packages
1.8.3p1-1ubuntu3 0
500 http://us.archive.ubuntu.com/ubuntu/ precise/main i386 Packages
type -a sudo is
sudo is /usr/bin/sudo
sha256sum $(which sudo) is
0efd358e04ea07dc73b67642d9bb85f49143c65996a7c88a57b42557a0b0a50d /usr/bin/sudo
pkexec echo success did this:
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/echo' as the super user
Multiple identities can be used for authentication:
1. My Name,,, (me)
2. ,Account used for Git,, (git)
3. Coworker1,,, (cw1)
4. Coworker2,,, (cw2)
5. Coworker3,,, (cw3)
6. My Name,,, (me)
7. Coworker4,,, (cw4)
8. Coworker5,,, (cw5)
9. ,Account used for Git,, (git)
Choose identity to authenticate as (1-9): 1
Password:
==== AUTHENTICATION COMPLETE ===
success
Names have been changed to protect the mostly innocent. I show up twice, for some reason. But none of the other coworkers can use Sudo either (the ones that could pre-upgrade anyways).
Here's the output of a few more commands.
visudo the sudoers file and added
kml ALL=(ALL:ALL) ALL under the root line
sudo -i echo success returned the same as before, nothing.
echo foo | sudo tee foo.txt; ls -l foo.txt yielded:
ls: cannot access foo.txt: No such file or directory
How I reinstalled Sudo.
I accomplished this twice.
The first time I ran
apt-get install --reinstall sudo --From root
That accomplished little, so I uninstalled first via:
apt-get uninstall sudo followed by
apt-get install sudo
Edit more info, reditied
sudo returns silent after password authentication and doesn't ask again.
sudo -k and sudo -K also fails silently I was logged in as root, it prompts for a password on a normal account.
More info 2
I ran tail -f /var/log/auth.log
Here's the output from my sudo ls from my kml account
Feb 6 16:33:27 rhythmsdev sudo: pam_unix(sudo:session): session opened for user root by kml(uid=1010)
Feb 6 16:33:27 rhythmsdev sudo: pam_unix(sudo:session): session closed for user root
Attempting an incorrect password prompts for a new password, and logs this
Feb 6 16:35:17 rhythmsdev sudo: pam_unix(sudo:auth): authentication failure; logname=kml uid=1010 euid=0 tty=/dev/pts/0 ruser=kml rhost= user=kml
ed3
sudo apt-get clean && sudo apt-get update && sudo apt-get --purge --reinstall install sudo
Sudo still doesn't work. Here was the output
apt-get install --purge --reinstall sudo
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
mono-2.0-gac libxcb-aux0 python-fstab libgnomekbd4 libts-0.0-0 libwpd8c2a libcdio10 xsltproc pnm2ppa librpmbuild0 libcolamd2.7.1 lp-solve libglitz-glx1 openoffice.org-writer libntfs10 python-gnome2 libxcb-render-util0 libevent-1.4-2
gnome-media gnome-desktop-data libgtk-vnc-1.0-0 libgnomepanel2.24-cil xulrunner-1.9.2 libxcb-event1 libindicator0 linux-headers-2.6.32-38 libicu42 openoffice.org-draw libdbusmenu-glib1 ubufox python-aptdaemon-gtk openoffice.org-gtk
libsilc-1.1-2 libgnome-media0 libbeagle1 g++-4.4 libexchange-storage1.2-3 libgraphite3 libwpg-0.1-1 libibus1 libproxy0 libnm-util1 python-gtksourceview2 libevview2 scrollkeeper libindicate-gtk2 libwebkit-1.0-2
libmono-system-runtime2.0-cil libpisock9 libdns64 libcamel1.2-14 bcmwl-modaliases librpmio0 librpm0 libgnome2-perl libaccess-bridge-java-jni libstdc++6-4.4-dev libeggdbus-1-0 libnspr4-0d libgtkhtml-editor0 esound-common
python-pyorbit gdebi-core libnotify1 python-telepathy libedata-cal1.2-6 libaccess-bridge-java libdevkit-power-gobject1 gnome-media-common librasqal2 libpango1.0-common ubuntuone-client-gnome cups-driver-gutenprint libgadu3
openoffice.org-style-human libmono-cairo2.0-cil libisccc60 cpu-checker libgweather1 python-gtkspell libgnome-bluetooth7 libxxf86misc1 libloudmouth1-0 libsexy2 libxcb-atom1 libido-0.1-0 libgmime2.4-cil compiz-plugins libffi5
libgnome-pilot2 libdirectfb-1.2-0 openoffice.org-style-galaxy libgssdp-1.0-2 libcryptui0 finger libmusicbrainz4c2a python-pyatspi libgp11-0 libjs-mootools python-webkit libgcr0 libqt4-webkit libcdio-cdda0 libhunspell-1.2-0 liblwres60
libgmp3c2 libgtksourceview2.0-common openoffice.org-math libhal1 libgtksourceview2.0-0 hal libgnome2-vfs-perl libprotobuf5 libesd0 openoffice.org-common libegroupwise1.2-13 libdbusmenu-gtk1 libgsf-1-common gnome-doc-utils
libecal1.2-7 at-spi libpoppler5 libgmime-2.4-2 libgdata1.2-1 libedataserver1.2-11 libhal-storage1 libpython2.6 gnome-system-monitor libmldbm-perl libbind9-60 libimobiledevice0 libgtkmm-2.4-1c2a libglitz1 libevdocument2
libgdata-google1.2-1 libspeechd2 fglrx-modaliases libnunit2.4-cil libclutter-gtk-0.10-0 libebook1.2-9 libmagickcore2 libaudiofile0 libwps-0.1-1 libedataserverui1.2-8 nvidia-173-modaliases libphonon4 libgnome-window-settings1
libedata-book1.2-2 libgdata6 libxss1 libgs8 openoffice.org-emailmerge libappindicator0 liblpint-bonobo0 ntfsprogs libjpeg62 libgtkhtml-editor-common libqt4-designer libmpfr1ldbl libcdio-paranoia0 libmysqlclient16 libmagickwand2
libisccfg60 libfreezethaw-perl smartdimmer libgupnp-1.0-3 screen-resolution-extra libnl1 libanthy0 tsconf liboobs-1-4 libgucharmap7 libgksu2-0 libdb4.7 libsilcclient-1.1-3 libindicate4 libndesk-dbus-glib1.0-cil libraptor1 python-wnck
liboil0.3 libebackend1.2-0 firefox-branding hal-info speech-dispatcher libgnome-desktop-2-17 fuse-utils python-desktopcouch gwibber libisc60 libnice0 linux-headers-2.6.32-38-generic libnautilus-extension1 compiz-fusion-plugins-main
gnome-applets-data min12xxw libwebkit-1.0-common libavahi-ui0 libprotoc5 nvidia-96-modaliases libavahi-core6 libgupnp-igd-1.0-2 libgnome2-canvas-perl libgtkhtml3.14-19 libgsf-1-114 python-rdflib gnome-panel-data libpoppler-glib4
libpisync1 libdotconf1.0 python-indicate
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 16 not upgraded.
Need to get 292 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main sudo i386 1.8.3p1-1ubuntu3.3 [292 kB]
Fetched 292 kB in 0s (742 kB/s)
(Reading database ... 310429 files and directories currently installed.)
Preparing to replace sudo 1.8.3p1-1ubuntu3.3 (using .../sudo_1.8.3p1-1ubuntu3.3_i386.deb) ...
Unpacking replacement sudo ...
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Setting up sudo (1.8.3p1-1ubuntu3.3) ...
edit 4
sha256sum /usr/lib/sudo/sudoers.so /usr/lib/sudo/sudo_noexec.so results in
6f2e56e05d9a3de942558255b72d59a147be2c637247e244c365838378fe6ec3 /usr/lib/sudo/sudoers.so
7db6a45129ec1ef6d4cb21d7a488a85f5b45e4d21990116f64c9e71f116648c0 /usr/lib/sudo/sudo_noexec.so
Sudo as another user, (ran as root)
root@rhythmsdev:/home/kml# sudo -u kml echo success
root@rhythmsdev:/home/kml#
edit 5
Using the scripts provided by Eliah Kagan here I checked for duplicate groups & id's. All the diffs come up blank.
edit 6
strace echo success here
edit 7
root@rhythmsdev:/home/kml# sudo echo success
root@rhythmsdev:/home/kml# echo $?
1
edit 8
This seems interesting, this is different than a server that has working sudo
root@rhythmsdev:/home/kml# sudo -l
Matching Defaults entries for root on this host:
env_reset,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User root may run the following commands on this host:
(ALL : ALL) ALL
(ALL) ALL
root@rhythmsdev:/home/kml#
That's me as root
Me as me (not root)
kml@rhythmsdev:~$ sudo -l
[sudo] password for kml:
Matching Defaults entries for kml on this host:
env_reset,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User kml may run the following commands on this host:
(ALL : ALL) ALL
(ALL) ALL
(ALL : ALL) ALL
kml@rhythmsdev:~$
Thank you,
I'm fresh out of ideas at the moment.
This was anti-climatic…
I was able to fix it by changing one line in my sudoers file.
I altered this line
Defaults env_reset
and I changed it to
Defaults !env_reset
This was because I noticed that sudo -E was working. So I did some research and found out a way to prevent sudo from wiping out your environmental variables. So far that seems to have fixed it. What I need to do is figure out which environmental variable needs to be kept and I'll add it in with env_keep+=
That you all for your help and support, I'll keep updating this. I'm not sure if someone had suggested sudo -E before let me know, and I'll award the bounty to that person.
ed1
So I might be creating security issues with the !env_reset. I'll keep updating.