sudo problem

[Arockia Jegan]

Hi,

I'm using Sudo version 1.6.2b1 on hpux 11.11 system. I have couple of users in the DBA group.

User_Alias DBADMIN = %dba
DBADMIN ALL = (oracle) ALL

Now one of the users is having problem when he runs the following command,

sudo -u oracle ksh

It prompts him to enter his own account password. But when he types his password it says,

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these two things:

#1) Respect the privacy of others.
#2) Think before you type.


Sorry, try again

He's entering the right password but it's giving this message. Even he changed the password and tried again. It didn't help.

In the syslog.log file it's showing

1 incorrect password attempt

But he's entering the right PASSWORD. Any ideas?

[Shannon Petry]

Did you also configure the command including the path to be an allowable command for that user?

I dont recall the documentation saying that you had to do this (it may have), but I know I have to list commands that users can use in an ACL.

Regards,
Shannon

[Arockia Jegan]

I'm using DBADMIN ALL= (oracle) ALL

So they will be able to use all the commands. So I don't require to add the command alias

[Tom Maloy]

Sounds like you just recently added the DBADMIN entries.

I saw this problem when I had a user with their own individual entry AND when they were also in a group. There was some kind of conflict because the user was (effectively) in the file twice.

When I removed the individual entry, the problem was solved.

Besides being in the DBADMIN group, does your user have their own entry?

[Nick Wickens]

Do you have the following line in sudoers file ?

Runas_Alias oracle=oracle

I have to do this for Informix

[Arockia Jegan]

Tom,

The user doesn't have his own individual entry. More than 10 users are in the dba group. They all are able to use sudo (sudo -u oracle ksh).

Another user of the dba group had the same issue. We changed his password and it worked fine with the new password.


Nick,

I don't have that line in the sudoers file. But I don't have any issue for other users. It's happening with only one user

[Bill Hassell]

Ask the user how many characters they type for their password. HP-UX login(older, untrusted versions) has an annoying habit of accepting more than 8 characters in a password, tossing the extras away and matching what's left. This is not how other authentication programs work (ie, sudo) where every character counts.