Edit File: TROUBLESHOOTING
Troubleshooting tips and FAQ for Sudo ===================================== Q) When I run configure, it says "C compiler cannot create executables". A) This usually means you either don't have a working compiler. This could be due to the lack of a license or that some component of the compiler suite could not be found. Check config.log for clues as to why this is happening. On many systems, compiler components live in /usr/ccs/bin which may not be in your PATH environment variable. Q) When I run configure, it says "sudo requires the 'ar' utility to build". A) As part of the build process, sudo creates a temporary library containing objects that are shared amongst the different sudo executables. On Unix systems, the "ar" utility is used to do this. This error indicates that "ar" is missing on your system. On Solaris systems, you may need to install the SUNWbtool package. On other systems "ar" may be included in the GNU binutils package. Q) Sudo compiles and installs OK but when I try to run it I get: /usr/local/bin/sudo must be owned by uid 0 and have the setuid bit set A) Sudo must be setuid root to do its work. Either /usr/local/bin/sudo is not owned by uid 0 or the setuid bit is not set. This should have been done for you by "make install" but you can fix it manually by running the following as root: # chown root /usr/local/bin/sudo; chmod 4111 /usr/local/bin/sudo Q) Sudo compiles and installs OK but when I try to run it I get: effective uid is not 0, is /usr/local/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? A) The owner and permissions on the sudo binary appear to be OK but when sudo ran, the setuid bit did not have an effect. There are two common causes for this. The first is that the file system the sudo binary is located on is mounted with the 'nosuid' mount option, which disables setuid binaries. The other is that sudo is installed on an NFS-mounted file system that is exported without root privileges. By default, NFS file systems are exported with uid 0 mapped to a non-privileged uid (usually -2). You need to do something like `chmod 4111 /usr/local/bin/sudo'. Also, the file system sudo resides on must *not* be mounted (or exported) with the nosuid option or sudo will not be able to work. Another possibility is you may have '.' in your $PATH before the directory containing sudo. If you are going to have '.' in your path you should make sure it is at the end. Q) Sudo never gives me a chance to enter a password using PAM, it just says 'Sorry, try again.' three times and exits. A) You didn't setup PAM to work with sudo. On RedHat Linux or Fedora Core this generally means installing sample.pam as /etc/pam.d/sudo. See the sample.pam file for hints on what to use for other Linux systems. Q) Sudo says 'Account expired or PAM config lacks an "account" section for sudo, contact your system administrator' and exits but I know my account has not expired. A) Your PAM config lacks an "account" specification. On Linux this usually means you are missing a line like: account required pam_unix.so in /etc/pam.d/sudo. Q) Sudo is setup to log via syslog(3) but I'm not getting any log messages. A) Make sure you have an entry in your syslog.conf file to save the sudo messages (see the sample.syslog.conf file). The default log facility is authpriv (changeable via configure or in sudoers). Don't forget to send a SIGHUP to your syslogd so that it re-reads its conf file. Also, remember that syslogd does *not* create log files, you need to create the file before syslogd will log to it (ie: touch /var/log/sudo). Note: the facility (e.g. "auth.debug") must be separated from the destination (e.g. "/var/log/auth" or "@loghost") by tabs, *not* spaces. This is a common error. Q) When sudo asks me for my password it never accepts what I enter even though I know I entered my password correctly. A) If you are not using pam and your system uses shadow passwords, it is possible that sudo didn't properly detect that shadow passwords are in use. Take a look at the generated config.h file and verify that the C function used for shadow password look ups was detected. For instance, for SVR4-style shadow passwords, HAVE_GETSPNAM should be defined (you can search for the string "shadow passwords" in config.h with your editor). Note that there is no define for 4.4BSD-based shadow passwords since that just uses the standard getpw* routines. Q) Can sudo use the ssh agent for authentication instead of asking for the user's Unix password? A) Not directly, but you can use a PAM module like pam_ssh_agent_auth or pam_ssh for this purpose. Q) I don't want the sudoers file in /etc, how can I specify where it should go? A) Use the --sysconfdir option to configure. Ie: configure --sysconfdir=/dir/you/want/sudoers/in Q) Can I put the sudoers file in NIS/NIS+ or do I have to have a copy on each machine? A) There is no support for making an NIS/NIS+ map/table out of the sudoers file at this time. You can distribute the sudoers file via rsync or rdist. It is also possible to NFS-mount the sudoers file. If you use LDAP at your site you may be interested in sudo's LDAP sudoers support, see the README.LDAP file and the sudoers.ldap manual. Q) I don't run sendmail on my machine. Does this mean that I cannot use sudo? A) No, you just need to disable mailing with a line like: Defaults !mailerpath in your sudoers file or run configure with the --without-sendmail option. Q) When I run visudo it uses vi as the editor and I hate vi. How can I make it use another editor? A) You can specify the editor to use in visudo in the sudoers file. See the "editor" and "env_editor" entries in the sudoers manual. The defaults can also be set at configure time using the --with-editor and --with-env-editor configure options. Q) Sudo appears to be removing some variables from my environment, why? A) Sudo removes the following "dangerous" environment variables to guard against shared library spoofing, shell voodoo, and kerberos server spoofing. IFS LOCALDOMAIN RES_OPTIONS HOSTALIASES NLSPATH PATH_LOCALE TERMINFO TERMINFO_DIRS TERMPATH TERMCAP ENV BASH_ENV LC_ (if it contains a '/' or '%') LANG (if it contains a '/' or '%') LANGUAGE (if it contains a '/' or '%') LD_* _RLD_* SHLIB_PATH (HP-UX only) LIBPATH (AIX only) KRB5_CONFIG (kerb5 only) VAR_ACE (SecurID only) USR_ACE (SecurID only) DLC_ACE (SecurID only) Q) How can I keep sudo from asking for a password? A) To specify this on a per-user (and per-command) basis, use the 'NOPASSWD' tag right before the command list in sudoers. See the sudoers man page and sample.sudoers for details. To disable passwords completely, add !authenticate" to the Defaults line in /etc/sudoers. You can also turn off authentication on a per-user or per-host basis using a user or host-specific Defaults entry in sudoers. To hard-code the global default, you can configure with the --without-passwd option. Q) When I run configure, it dies with the following error: "no acceptable cc found in $PATH". A) /usr/ucb/cc was the only C compiler that configure could find. You need to tell configure the path to the "real" C compiler via the --with-CC option. On Solaris, the path is probably something like "/opt/SUNWspro/SC4.0/bin/cc". If you have gcc that will also work. Q) When I run configure, it dies with the following error: Fatal Error: config.cache exists from another platform! Please remove it and re-run configure. A) configure caches the results of its tests in a file called config.cache to make re-running configure speedy. However, if you are building sudo for a different platform the results in config.cache will be wrong so you need to remove config.cache. You can do this by "rm config.cache" or "make realclean". Note that "make realclean" will also remove any object files and configure temp files that are laying around as well. Q) I built sudo on a Solaris >= 2.6 machine but the resulting binary doesn't work on Solaris <= 2.5.1. Why? A) Starting with Solaris 2.6, snprintf(3) is included in the standard C library. To build a version of sudo on a >= 2.6 machine that will run on a <= 2.5.1 machine, edit config.h and comment out the lines: #define HAVE_SNPRINTF 1 #define HAVE_VSNPRINTF 1 and run make. Q) When I run "visudo" it says "sudoers file busy, try again later." and doesn't do anything. A) Someone else is currently editing the sudoers file with visudo. Q) When I try to use "cd" with sudo it says "cd: command not found". A) "cd" is a shell built-in command, you can't run it as a command since a child process (sudo) cannot affect the current working directory of the parent (your shell). Q) When I try to use "cd" with sudo the command completes without errors but nothing happens. A) Even though "cd" is a shell built-in command, some operating systems include a /usr/bin/cd command for some reason. A standalone "cd" command is totally useless since a child process (cd) cannot affect the current working directory of the parent (your shell). Thus, "sudo cd /foo" will start a child process, change the directory and immediately exit without doing anything useful. Q) When I run sudo it says I am not allowed to run the command as root but I don't want to run it as root, I want to run it as another user. My sudoers file entry looks like: bob ALL=(oracle) ALL A) The default user sudo tries to run things as is always root, even if the invoking user can only run commands as a single, specific user. This may change in the future but at the present time you have to work around this using the 'runas_default' option in sudoers. For example: Defaults:bob runas_default=oracle would achieve the desired result for the preceding sudoers fragment. Q) When I try to run sudo via ssh, I get the error: sudo: no tty present and no askpass program specified A) ssh does not allocate a tty by default when running a remote command. Without a tty, sudo cannot disable echo when prompting for a password. You can use ssh's "-t" option to force it to allocate a tty. Alternately, if you do not mind your password being echoed to the screen, you can use the "visiblepw" sudoers option to allow this. Q) When I try to use SSL-enabled LDAP with sudo I get an error: unable to initialize SSL cert and key db: security library: bad database. you must set TLS_CERT in /etc/ldap.conf to use SSL A) On systems that use a Mozilla-derived LDAP SDK there must be a certificate database in place to use SSL-encrypted LDAP connections. This file is usually /var/ldap/cert8.db or /etc/ldap/cert8.db. The actual number after "cert" will vary, depending on the version of the LDAP SDK that is being used. If you do not have a certificate database you can either copy one from a mozilla-derived browser, such as firefox, or create one using the "certutil" command. You can run "certutil" as follows and press the <return> (or <enter>) key at the password prompt: # certutil -N -d /var/ldap Enter a password which will be used to encrypt your keys. The password should be at least 8 characters long, and should contain at least one non-alphabetic character. Enter new password: <return> Re-enter password: <return> Q) When I run sudo on AIX I get the following error: setuidx(ID_EFFECTIVE|ID_REAL|ID_SAVED, ROOT_UID): Operation not permitted. A) AIX's Enhanced RBAC is preventing sudo from running. To fix this, add the following entry to /etc/security/privcmds (adjust the path to sudo as needed) and run the setkst command as root: /usr/local/bin/sudo: accessauths = ALLOW_ALL innateprivs = PV_DAC_GID,PV_DAC_O,PV_DAC_R,PV_DAC_UID,PV_DAC_W,PV_DAC_X,PV_FS_CHOWN,PV_PROC_ENV,PV_PROC_PRIO,PV_PROC_RAC secflags = FSF_EPS Q) When I run configure I get the following error: dlopen present but libtool doesn't appear to support your platform. A) Libtool doesn't know how to support dynamic linking on the operating system you are building for. If you are cross-compiling, you need to specify the operating system, not just the CPU type. For example: --host powerpc-unknown-linux instead of just: --host powerpc Q) How do you pronounce `sudo'? A) The official pronunciation is soo-doo (for su "do"). However, an alternate pronunciation, a homophone of "pseudo", is also common.
Back to File Manager