Home / server / Questions / 220603
Accepted
Gnudiff
Asked: 2011-01-11 03:52:55 +0800 CST

Sudo asks for password twice with LDAP authentication

  • 772

I have Ubuntu 8.04 LTS machine and Windows 2003 AD domain.

I have succesfully set up that I can log in with domain username and password, using domain prefix, like "domain+username".

Upon login to machine it all works first try, however, for some reason when I try to sudo my logged in user, it asks for the password twice every time when I try sudo. It accepts the password after 2nd time, but not the first time.

Once or twice I might think I just keep entering wrong pass the first time, but this is what happens always, any ideas of what's wrong?

pam.conf is empty pam.d/sudo only includes common-auth & common-account, and

common-auth is:

auth    sufficient      pam_unix.so nullok_secure
auth    sufficient      pam_winbind.so
auth    requisite       pam_deny.so
auth    required        pam_permit.so
ubuntu active-directory ldap sudo

4 Answers

  1. Best Answer

    in PAM there is an option called "use_first_pass" : 

    auth        sufficient    pam_ldap.so use_first_pass

    try enabling it for ldap, should fix your issue

    • 3

  2. Try to change this line:

    auth    sufficient      pam_winbind.so

    to

    auth    sufficient      pam_winbind.so try_first_pass
    • 2

  3. I have the same problem and removing:

    auth sufficient pam_unix.so nullok

    from /etc/pam.d/common-auth and adding:

    auth sufficient pam_ldap.so use_first_pass

    solved the problem :-).

    • 2

  4. Besides from being an Ubuntu 14.04 installation, I had this same problem, which started after a failed sudo apt-get update && sudo apt-get upgrade attempt in which I had to turn off the machine in the middle of the upgrade. Although in my case /etc/pam.d/sudo had:

    @include common-auth
@include common-account
@include common-session-noninteractive

    I just commented out @include common-session-noninteractive (i.e: adding a # in front of that line, like # @include common-session-noninteractive) and now everything is back to normal asking only once for the password when using sudo. So far so good. Hope this helps!

    • 0