Unable to sudo to root on console (/dev/console) window

[Ra Jose]

Hello freinds,

We have sudo setup in our environment, so if user wants to become root, user has to
$ sudo su -
Then enter user's password.
This will put the user on root id. This works fine, if I open a ssh or telnet window to the server (IA or PA).
But if the user logs into MP and opens a console window, user will be presented to login. User enters login/pw info and is logged in. Now, on the console window, if you try to
sudo su -
it will error out. I am unable to figure out
why sudo su - works on regular telnet/ssh winow and does not work on console window.

Some out put I have given below -
$> sudo su -
Password:
Sorry, try again.
Password:
sudo: 1 incorrect password attempt
Jan 17 13:16:29 f3e1qa11 sudo: rajose : 1 incorrect password attempt ; TTY=console ; PWD=/home/rajose ; USER=root ; COMMAND=/usr/bin/su -

$> tty
/dev/console

Anyone has noticed this? Any help is appreciated.

Thank you
Rajose

[Matti_Kurkela]

If you've logged on as a non-root user from the MP console, check your TERM environment variable and "stty -a" settings first.

Chances are, your TERM will be set to "dumb" and your intr, erase and kill characters are not what you'd expect. Like on ancient Teletypes, # will mean "delete character" and @ will be "kill (delete) entire line".

If your password contains these characters, you'll surely fail unless you fix these settings first.

So:

TERM=vt100 # or xterm or whatever you've got
stty intr ^C kill ^U erase ^? susp ^Z

MK

[Ra Jose]

TERM is set to vt100 and all stty setting are right. The sudo still does not allow me to become root on console window.

[IT Response]

If it is a trusted system, this behavior can be changed by adding "timeout_timestamp=0" to the sudoers file(/opt/iexpress/sudo/etc/sudoers)

[Ra Jose]

Is it timeout_timestamp or timestamp_timeout,

In my sudoers file, I put it like this -
Defaults logfile=/var/adm/sudo.log, timeout_timestamp=0
The visudo did not recognize this parameter.
Then I chaged to timestamp_timeout=0, it
saved the file without errors.

I tried sudo su - on my console window,
it still says -
$ sudo su -
Password:
Sorry, try again.
Password:
sudo: 1 incorrect password attempt
Jan 31 11:00:39 fex2 sudo: user : 1 incorrect password attempt ; TTY=console ; PWD= ; USER=root ; COMMAND=/usr/bin/su -
$ tty
/dev/console
$

Although I am giving correct user password, it
still does not change to root on console window. It is a trusted system.

[Torsten.]

Question is not answered yet:

Does the password contain @ or #?

See Matti's post.

BTW, maybe I miss something here, but is there a basic difference between a plain "su -" and your command (why do you use sudo here)?

[OldSchool]

"BTW, maybe I miss something here, but is there a basic difference between a plain "su -" and your command (why do you use sudo here)?"

Torsten - lets him su from a user to root w/o knowing root's password. it *should* be (based on the error message) asking for the password of user "rajose".

I gotta admit, I've never tried this, or sudo from the console either

[Ra Jose]

well, the site here uses sudo. We are not
given root passwords. It is centrally maintained by security group. The sysadmins have been given access to root privilege via sudo.

So if I have to make modifications to the system, I change to root via sudo. This asks my user password and lets me into the system as root. All activities are logged. Once I am done, I exit out of this and become ordinary user.

The su - command does changes to root but asks for root pw which we don't know. Hence, sudo has this privilege.

I will double check once again the terminal settings to make sure the stty and my characters in password do not match.

Rajose.

[Torsten.]

Got it, thanks.

IMHO it's time to check the password now.
No @ and # and no longer than 8 chars?

[Ra Jose]

I checked password. It is <8 chars and
contain only alpha-numeric. I still get
error changing to root via sudo on console.

If anyone had sudo implementation, they can
probably try this.
Rajose.

[OldSchool]

well...i *did* try it on an older system (hpux 11.0 and sudo 1.6.8p5 and a green-screen console).

Logged in at the console using my personal id and ran "/usr/local/bin/sudo su -".

Accepted my password and logged me in as root....no issues..

[Ra Jose]

Thx Oldschool. Let me check the sudo version
and see if I can get the latest and try.

[Ra Jose]

The new version of sudo worked fine.

[Ra Jose]

The new version of sudo resolved the issue.
1.6.9p8 is the new version available on
HP's swdepot under security category

Rajose.