1 Troubleshooting tips and FAQ for Sudo
2 =====================================
4 Q) When I run configure, it says "C compiler cannot create executables".
5 A) This usually means you either don't have a working compiler. This
6 could be due to the lack of a license or that some component of the
7 compiler suite could not be found. Check config.log for clues as
8 to why this is happening. On many systems, compiler components live
9 in /usr/ccs/bin which may not be in your PATH environment variable.
11 Q) Sudo compiles but when I run it I get "Sorry, sudo must be setuid root."
13 A) Sudo must be setuid root to do its work. You need to do something like
14 `chmod 4111 /usr/local/bin/sudo'. Also, the filesystem sudo resides
15 on must *not* be mounted with the nosuid mount option or sudo will
16 not be able to work. Another possibility is you may have '.' in
17 your $PATH before the directory containing sudo. If you are going
18 to have '.' in your path you should make sure it is at the end.
20 Q) Sudo compiles but when I run it I get "seteuid(0) failed, your operating
21 system may have broken POSIX saved ID support\nTry running configure with
22 --disable-saved-ids" and sudo quits.
23 A) The operating system you are running probably has broken support for
24 POSIX saved IDs. You should run configure with the "--disable-saved-ids"
25 option and rebuild sudo.
27 Q) Sudo never gives me a chance to enter a password using PAM, it just
28 says 'Sorry, try again.' three times and quits.
29 A) You didn't setup PAM to work with sudo. On Linux this generally
30 means installing sample.pam as /etc/pam.d/sudo.
32 Q) Sudo is setup to log via syslog(3) but I'm not getting any log
34 A) Make sure you have an entry in your syslog.conf file to save
35 the sudo messages (see the sample.syslog.conf file). The default
36 log facility is local2 (changeable via configure). Don't forget
37 to send a SIGHUP to your syslogd so that it re-reads its conf file.
38 Also, remember that syslogd does *not* create log files, you need to
39 create the file before syslogd will log to it (ie: touch /var/log/sudo).
40 Note: the facility ("local2.debug") must be separated from the
41 destination ("/var/adm/sudo.log" or "@loghost") by
42 tabs, *not* spaces. This is a common error.
44 Q) When sudo asks me for my password it never accepts what I enter even
45 though I know I entered my password correctly.
46 A) If your system uses shadow passwords, it is possible that sudo
47 didn't detect this. Take a look at the generated config.h file
48 and verify that the C function used for shadow password lookups
49 was detected. For instance, for SVR4-style shadow passwords,
50 HAVE_GETSPNAM should be defined (you can search for the string
51 "shadow passwords" in config.h with your editor). Note that
52 there is no define for 4.4BSD-based shadow passwords since that
53 just uses the standard getpw* routines.
55 Q) I don't want the sudoers file in /etc, how can I specify where it
57 A) Use the --sysconfdir option to configure. Ie:
58 configure --sysconfdir=/dir/you/want/sudoers/in
60 Q) Can I put the sudoers file in NIS/NIS+ or do I have to have a
62 A) There is no support for making an NIS/NIS+ map/table out of
63 the sudoers file at this time. A good way to distribute the
64 sudoers file is via rdist(1). It is also possible to NFS-mount
67 Q) I don't run sendmail on my machine. Does this mean that I cannot
69 A) No, you just need to run use the --without-sendmail argument to configure
70 or add "!mailerpath" to the Defaults line in /etc/sudoers.
72 Q) When I run visudo it uses vi as the editor and I hate vi. How
73 can I make it use another editor?
74 A) Your best bet is to run configure with the --with-env-editor switch.
75 This will make visudo use the editor specified by the user's
76 EDITOR environment variable. Alternately, you can run configure
77 with the --with-editor=/path/to/another/editor.
79 Q) Sudo appears to be removing some variables from my environment, why?
80 A) Sudo removes the following "dangerous" environment variables
81 to guard against shared library spoofing, shell voodoo, and
82 kerberos server spoofing.
95 LC_ (if it contains a '/' or '%')
96 LANG (if it contains a '/' or '%')
97 LANGUAGE (if it contains a '/' or '%')
100 SHLIB_PATH (HP-UX only)
102 KRB_CONF (kerb4 only)
103 KRBCONFDIR (kerb4 only)
104 KRBTKFILE (kerb4 only)
105 KRB5_CONFIG (kerb5 only)
106 VAR_ACE (SecurID only)
107 USR_ACE (SecurID only)
108 DLC_ACE (SecurID only)
110 Q) How can I keep sudo from asking for a password?
111 A) To specify this on a per-user (and per-command) basis, use the 'NOPASSWD'
112 tag right before the command list in sudoers. See the sudoers man page
113 and sample.sudoers for details. To disable passwords completely,
114 run configure with the --without-passwd option or add "!authenticate"
115 to the Defaults line in /etc/sudoers. You can also turn off authentication
116 on a per-user or per-host basis using a user or host-specific Defaults
119 Q) When I run configure, it dies with the following error:
120 "no acceptable cc found in $PATH".
121 A) /usr/ucb/cc was the only C compiler that configure could find.
122 You need to tell configure the path to the "real" C compiler
123 via the --with-CC option. On Solaris, the path is probably
124 something like "/opt/SUNWspro/SC4.0/bin/cc". If you have gcc
127 Q) When I run configure, it dies with the following error:
128 Fatal Error: config.cache exists from another platform!
129 Please remove it and re-run configure.
130 A) configure caches the results of its tests in a file called
131 config.cache to make re-running configure speedy. However,
132 if you are building sudo for a different platform the results
133 in config.cache will be wrong so you need to remove config.cache.
134 You can do this by "rm config.cache" or "make realclean".
135 Note that "make realclean" will also remove any object files
136 and configure temp files that are laying around as well.
138 Q) I built sudo on a Solaris >= 2.6 machine but the resulting binary
139 doesn't work on Solaris <= 2.5.1. Why?
140 A) Starting with Solaris 2.6, snprintf(3) is included in the standard
141 C library. To build a version of sudo on a >= 2.6 machine that
142 will run on a <= 2.5.1 machine, edit config.h and comment out the lines:
143 #define HAVE_SNPRINTF 1
144 #define HAVE_VSNPRINTF 1
147 Q) When I run "visudo" it says "sudoers file busy, try again later."
148 and doesn't do anything.
149 A) Someone else is currently editing the sudoers file with visudo.
151 Q) When I try to use "cd" with sudo it says "cd: command not found".
152 A) "cd" is a shell builtin, you can't run it as a command since
153 a child process (sudo) cannot affect the current working directory
154 of the parent (your shell).
156 Q) When I try to use "cd" with sudo the command completes without
157 errors but nothing happens.
158 A) Some SVR4-derived OS's include a /usr/bin/cd command for reasons
159 unfathomable. A "cd" command is totally useless since a child process
160 cannot affect the current working directory of the parent (your shell).
162 Q) When I run sudo it says I am not alllowed to run the command as root
163 but I don't want to run it as root, I want to run it as another user.
164 My sudoers file entry looks like:
166 A) The default user sudo tries to run things as is always root, even if
167 the invoking user can only run commands as a single, specific user.
168 This may change in the future but at the present time you have to
169 work around this using the 'runas_default' option in sudoers.
171 Defaults:bob runas_default=oracle
172 would achieve the desired result ofr the preceding sudoers fragment.
174 Q) How do you pronounce `sudo'?
175 A) soo-doo (for superuser do).
projects / debian / sudo / blob