The macosxhints Forums

The macosxhints Forums (http://hintsforums.macworld.com/index.php)
-   UNIX - General (http://hintsforums.macworld.com/forumdisplay.php?f=16)
-   -   sudo password not accepted (http://hintsforums.macworld.com/showthread.php?t=23765)

dfmiller 06-09-2004 12:59 PM

OK, thats what I'll do, though I'm on panther, not jaguar.

Quote:

Originally Posted by hayne
The safest thing would be to do an archive and install. I.e. reinstall Jaguar (from your install CDs)

After backup, I'll put in the panther disks and install on top of current installation. Thanks

Whit

jeremyg 06-10-2004 09:55 PM

i have postgresql, fink and php installed on my panther 10.3.3 machine. if i re-install osX keeping user data will these programs remain since some of their files are in the "hidden" unix directories underneath the mac interface?
jeremy

mervTormel 06-10-2004 10:17 PM

it might help to open a new thread about this?

fink is autonomous, and safe, at /sw

you'll need to know where your php and postgres are installed and if they are safe.

/usr/local is considered safe/untouchable.

vendor reserved root dirs:

Applications/
Developer/
Library/
Network/
System/
Trash/
Users/
Volumes/
automount/
bin/
cores/
dev/
lost+found/
private/
sbin/
usr/ *

* with the exception that /usr/local remains safe

lolajl 06-18-2004 09:09 AM

I'm having basically the same problem as well. I cannot do sudo as myself even though I'm the only administrator for this laptop (in other words, I'm the only one who uses it). I went through some of the steps to diagnose this problem.

It turns out that my uid is set to 501, and gid is set to 20. Authentication authority is set to basic. Groups=20 is set to staff; 80 to admin. Sudo seems to have the proper permission set (-r-s--x--x). There was a suggestion on making changes in NetInfo Manager but there wasn't any instructions on doing so.

So, it looks like I need to change groups to 80, right?

yellow 06-18-2004 09:20 AM

Did you install the WebSharing update too?

In the Terminal type:
groups

That will tell you what groups your admin account is in.

lolajl 06-18-2004 09:53 AM

Quote:

Originally Posted by yellow
Did you install the WebSharing update too?


Where would I get this from? Wasn't aware that I would need to install this.

Quote:

Originally Posted by yellow
That will tell you what groups your admin account is in.

I'm seeing:

staff admin

Should I be seeing something else as well?

yellow 06-18-2004 10:02 AM

Quote:

Originally Posted by lolajl
Where would I get this from? Wasn't aware that I would need to install this.

You don't need this. Some earlier posters in this thread with the same problem did install it and it broke their sudo.

Quote:

Originally Posted by lolajl
I'm seeing: staff admin
Should I be seeing something else as well?

No, not necessarily. What you see is normal. And as you can see, you are in the admin group already. And if you type id in the Terminal what do you get?

lolajl 06-18-2004 10:40 AM

Quote:

Originally Posted by yellow
You don't need this. Some earlier posters in this thread with the same problem did install it and it broke their sudo.

No, not necessarily. What you see is normal. And as you can see, you are in the admin group already. And if you type id in the Terminal what do you get?


As I said earlier, uid is 501, gid is 20, groups=20(staff), 80(admin)

yellow 06-18-2004 11:11 AM

Ooops, missed that. Yes, the GID should be 80. I don't know if this will work or not since your admin account appears to be messed up.

To change the GID, open NetInfo Manager, select users from the center panel, select your user, click the lock to attempt to unlock NetInfo manager, double click on the "Value" of the GID field, change it to 80, cmd-S to save NetInfo.

I don't know if you need to logout and log back in, assuming it works. If it doesn't let you authenticate against NetInfo Manager, do you have root enabled?

lolajl 06-18-2004 11:42 AM

Quote:

Originally Posted by yellow
I don't know if you need to logout and log back in, assuming it works. If it doesn't let you authenticate against NetInfo Manager, do you have root enabled?


Made the changes, logged out/in and still doesn't work when I go into terminal under my username.

I have root enabled, I believe, since I can do "sudo su -".

yellow 06-18-2004 12:26 PM

Quote:

Originally Posted by lolajl
Made the changes, logged out/in and still doesn't work when I go into terminal under my username. I have root enabled, I believe, since I can do "sudo su -".

weird. OK, lemme ruminate upon that. FYI, no need for sudo when doing "su -", if you're in the admin group you can su to root (or anyone else). OK, 2 new ideas. 1) Post the output of "ssh -V", 2) create a new admin user and verify that sudo is functional/broken for that user as well.

yellow 06-18-2004 12:56 PM

Quote:

Originally Posted by yellow
FYI, no need for sudo when doing "su -", if you're in the admin group you can su to root (or anyone else).

This statment is wrong, so let me clarify it. You can "su -" to root (from anyone) as long as you know the password for root. You can "su - username" to another user (from anyone) as long as you you know the username's password. You can use sudo (assuming you are an admin) to "su -" to anyone by simply using your admin account password. So you were quite right earlier, I don't want to confuse any future readers of this thread, so I had to correct myself.

lolajl 06-19-2004 10:42 PM

Quote:

Originally Posted by yellow
weird. OK, lemme ruminate upon that. FYI, no need for sudo when doing "su -", if you're in the admin group you can su to root (or anyone else). OK, 2 new ideas. 1) Post the output of "ssh -V", 2) create a new admin user and verify that sudo is functional/broken for that user as well.

Here's the output of ssh -V:

OpenSSH_3.6.1p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090702f

lolajl 06-19-2004 10:53 PM

Quote:

Originally Posted by yellow
2) create a new admin user and verify that sudo is functional/broken for that user as well.

And yes, the test admin user I created has permission denied when trying to do "cat /etc/sudoers".

Krazy 06-19-2004 11:08 PM

Quote:

Originally Posted by lolajl
Here's the output of ssh -V:

OpenSSH_3.6.1p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090702f

For what its worth, I have the same version under 10.3.4 + SecUpd2004-06-07Pan.pkg security update.


Quote:

Originally Posted by lolajl
And yes, the test admin user I created has permission denied when trying to do "cat /etc/sudoers".

This is also true for me. I can only cat the the sudoers file after sudo-ing, because its owned by root.

yellow 06-21-2004 10:13 AM

Quote:

Originally Posted by lolajl
And yes, the test admin user I created has permission denied when trying to do "cat /etc/sudoers".

Just like Krazy said, sudo (or root) is requires to read /etc/sudoers. Does that work on your new admin test user?

robek 07-07-2004 10:14 AM

Quote:

Originally Posted by lolajl
Made the changes, logged out/in and still doesn't work when I go into terminal under my username.

I have root enabled, I believe, since I can do "sudo su -".

I am another one having problems with sudo's password. I am trying to execute the 'sudo nvram boot-args=...' to activate my old video card. As a user, I am a member of the wheel group but not the admin group. I have sudo version 1.6.6 but a different size than reported earlier in this discussion. I have installed Panther 10.3.3 initially and upgraded to 10.3.4 using update panel. I can do 'su -' to switch to root or do 'su sysadmin' to switch to the admin account. Password are accepted as expected. But when I do sudo, entering either root or sysadmin password gives me "Sorry, try again." I checked that the sudoers file has read access by owner (root) and group wheel, and the content as it was reported in this thread.

So what gives? :confused:

derekhed 07-07-2004 02:13 PM

Please su to root and give us the results of:
cat /etc/sudoers

Do you have a line at the bottom with %admin ALL=(ALL ) ALL ?

robek 07-07-2004 05:11 PM

Quote:

Originally Posted by derekhed
Please su to root and give us the results of:
cat /etc/sudoers

Do you have a line at the bottom with %admin ALL=(ALL ) ALL ?

Yes. The file content are the two lines as somebody quoted earlier. Are you implying that wheel must be there as well or that I must be also be a member of the admin group. But in the latter case, what would be the point of having user accounts if everyone would need to be admin to sudo?

Robert

yellow 07-07-2004 05:47 PM

Quote:

Originally Posted by robek
Are you implying that wheel must be there as well or that I must be also be a member of the admin group. But in the latter case, what would be the point of having user accounts if everyone would need to be admin to sudo?

Yes, you must be in the admin group to use sudo.
The point of sudo is to not have to login as root (nor even enable root) in order to do things that need to be done as root. Those users that have no need to do admin things (and therefore, no need for sudo) do not need to be, nor should be, in the admin group. However, this is the default set up for the sudoers file. You can easily edit it to add particular users and enable sudo for them, yet they don't have to be part of the admin group. But that, IMO, is a colossal security risk that should be undertaken with the utmost of care.


All times are GMT -5. The time now is 05:48 PM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
Site design © IDG Consumer & SMB; individuals retain copyright of their postings
but consent to the possible use of their material in other areas of IDG Consumer & SMB.