topic Re: sudo problem in Operating System - HP-UX

sudo problem

Arockia Jegan — Fri, 30 Aug 2002 14:17:11 GMT

Hi,

I'm using Sudo version 1.6.2b1 on hpux 11.11 system. I have couple of users in the DBA group.

User_Alias DBADMIN = %dba
DBADMIN ALL = (oracle) ALL

Now one of the users is having problem when he runs the following command,

sudo -u oracle ksh

It prompts him to enter his own account password. But when he types his password it says,

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these two things:

#1) Respect the privacy of others.
#2) Think before you type.

Sorry, try again

He's entering the right password but it's giving this message. Even he changed the password and tried again. It didn't help.

In the syslog.log file it's showing

1 incorrect password attempt

But he's entering the right PASSWORD. Any ideas?

Re: sudo problem

Shannon Petry — Fri, 30 Aug 2002 14:37:50 GMT

Did you also configure the command including the path to be an allowable command for that user?

I dont recall the documentation saying that you had to do this (it may have), but I know I have to list commands that users can use in an ACL.

Regards,
Shannon

Re: sudo problem

Arockia Jegan — Fri, 30 Aug 2002 14:48:57 GMT

I'm using DBADMIN ALL= (oracle) ALL

So they will be able to use all the commands. So I don't require to add the command alias

Re: sudo problem

Tom Maloy — Fri, 30 Aug 2002 15:06:32 GMT

Sounds like you just recently added the DBADMIN entries.

I saw this problem when I had a user with their own individual entry AND when they were also in a group. There was some kind of conflict because the user was (effectively) in the file twice.

When I removed the individual entry, the problem was solved.

Besides being in the DBADMIN group, does your user have their own entry?

Re: sudo problem

Nick Wickens — Fri, 30 Aug 2002 15:24:57 GMT

Do you have the following line in sudoers file ?

Runas_Alias oracle=oracle

I have to do this for Informix

Re: sudo problem

Arockia Jegan — Fri, 30 Aug 2002 16:52:47 GMT

Tom,

The user doesn't have his own individual entry. More than 10 users are in the dba group. They all are able to use sudo (sudo -u oracle ksh).

Another user of the dba group had the same issue. We changed his password and it worked fine with the new password.

Nick,

I don't have that line in the sudoers file. But I don't have any issue for other users. It's happening with only one user

Re: sudo problem

Bill Hassell — Fri, 30 Aug 2002 20:47:59 GMT

Ask the user how many characters they type for their password. HP-UX login(older, untrusted versions) has an annoying habit of accepting more than 8 characters in a password, tossing the extras away and matching what's left. This is not how other authentication programs work (ie, sudo) where every character counts.