1 Troubleshooting tips and FAQ for Sudo
2 =====================================
4 Q) When I run configure, it says "C compiler cannot create executables".
5 A) This usually means you either don't have a working compiler. This
6 could be due to the lack of a license or that some component of the
7 compiler suite could not be found. Check config.log for clues as
8 to why this is happening. On many systems, compiler components live
9 in /usr/ccs/bin which may not be in your PATH environment variable.
11 Q) Sudo compiles but when I run it I get "Sorry, sudo must be setuid root."
13 A) Sudo must be setuid root to do its work. You need to do something like
14 `chmod 4111 /usr/local/bin/sudo'. Also, the file system sudo resides
15 on must *not* be mounted (or exported) with the nosuid option or sudo
16 will not be able to work. Another possibility is you may have '.' in
17 your $PATH before the directory containing sudo. If you are going
18 to have '.' in your path you should make sure it is at the end.
20 Q) Sudo never gives me a chance to enter a password using PAM, it just
21 says 'Sorry, try again.' three times and exits.
22 A) You didn't setup PAM to work with sudo. On Redhat Linux or Fedora
23 Core this generally means installing sample.pam as /etc/pam.d/sudo.
24 See the sample.pam file for hints on what to use for other Linux
27 Q) Sudo says 'Account expired or PAM config lacks an "account"
28 section for sudo, contact your system administrator' and exits
29 but I know my account has not expired.
30 A) Your PAM config lacks an "account" specification. On Linux this
31 usually means you are missing a line like:
32 account required pam_unix.so
35 Q) Sudo is setup to log via syslog(3) but I'm not getting any log
37 A) Make sure you have an entry in your syslog.conf file to save
38 the sudo messages (see the sample.syslog.conf file). The default
39 log facility is authpriv (changeable via configure or in sudoers).
40 Don't forget to send a SIGHUP to your syslogd so that it re-reads
41 its conf file. Also, remember that syslogd does *not* create
42 log files, you need to create the file before syslogd will log
43 to it (ie: touch /var/log/sudo).
44 Note: the facility (e.g. "auth.debug") must be separated from the
45 destination (e.g. "/var/log/auth" or "@loghost") by
46 tabs, *not* spaces. This is a common error.
48 Q) When sudo asks me for my password it never accepts what I enter even
49 though I know I entered my password correctly.
50 A) If your system uses shadow passwords, it is possible that sudo
51 didn't detect this. Take a look at the generated config.h file
52 and verify that the C function used for shadow password lookups
53 was detected. For instance, for SVR4-style shadow passwords,
54 HAVE_GETSPNAM should be defined (you can search for the string
55 "shadow passwords" in config.h with your editor). Note that
56 there is no define for 4.4BSD-based shadow passwords since that
57 just uses the standard getpw* routines.
59 Q) I don't want the sudoers file in /etc, how can I specify where it
61 A) Use the --sysconfdir option to configure. Ie:
62 configure --sysconfdir=/dir/you/want/sudoers/in
64 Q) Can I put the sudoers file in NIS/NIS+ or do I have to have a
66 A) There is no support for making an NIS/NIS+ map/table out of
67 the sudoers file at this time. A good way to distribute the
68 sudoers file is via rdist(1). It is also possible to NFS-mount
71 Q) I don't run sendmail on my machine. Does this mean that I cannot
73 A) No, you just need to run use the --without-sendmail argument to configure
74 or add "!mailerpath" to the Defaults line in /etc/sudoers.
76 Q) When I run visudo it uses vi as the editor and I hate vi. How
77 can I make it use another editor?
78 A) Your best bet is to run configure with the --with-env-editor switch.
79 This will make visudo use the editor specified by the user's
80 EDITOR environment variable. Alternately, you can run configure
81 with the --with-editor=/path/to/another/editor.
83 Q) Sudo appears to be removing some variables from my environment, why?
84 A) Sudo removes the following "dangerous" environment variables
85 to guard against shared library spoofing, shell voodoo, and
86 kerberos server spoofing.
99 LC_ (if it contains a '/' or '%')
100 LANG (if it contains a '/' or '%')
101 LANGUAGE (if it contains a '/' or '%')
104 SHLIB_PATH (HP-UX only)
106 KRB_CONF (kerb4 only)
107 KRBCONFDIR (kerb4 only)
108 KRBTKFILE (kerb4 only)
109 KRB5_CONFIG (kerb5 only)
110 VAR_ACE (SecurID only)
111 USR_ACE (SecurID only)
112 DLC_ACE (SecurID only)
114 Q) How can I keep sudo from asking for a password?
115 A) To specify this on a per-user (and per-command) basis, use the 'NOPASSWD'
116 tag right before the command list in sudoers. See the sudoers man page
117 and sample.sudoers for details. To disable passwords completely,
118 run configure with the --without-passwd option or add "!authenticate"
119 to the Defaults line in /etc/sudoers. You can also turn off authentication
120 on a per-user or per-host basis using a user or host-specific Defaults
123 Q) When I run configure, it dies with the following error:
124 "no acceptable cc found in $PATH".
125 A) /usr/ucb/cc was the only C compiler that configure could find.
126 You need to tell configure the path to the "real" C compiler
127 via the --with-CC option. On Solaris, the path is probably
128 something like "/opt/SUNWspro/SC4.0/bin/cc". If you have gcc
131 Q) When I run configure, it dies with the following error:
132 Fatal Error: config.cache exists from another platform!
133 Please remove it and re-run configure.
134 A) configure caches the results of its tests in a file called
135 config.cache to make re-running configure speedy. However,
136 if you are building sudo for a different platform the results
137 in config.cache will be wrong so you need to remove config.cache.
138 You can do this by "rm config.cache" or "make realclean".
139 Note that "make realclean" will also remove any object files
140 and configure temp files that are laying around as well.
142 Q) I built sudo on a Solaris >= 2.6 machine but the resulting binary
143 doesn't work on Solaris <= 2.5.1. Why?
144 A) Starting with Solaris 2.6, snprintf(3) is included in the standard
145 C library. To build a version of sudo on a >= 2.6 machine that
146 will run on a <= 2.5.1 machine, edit config.h and comment out the lines:
147 #define HAVE_SNPRINTF 1
148 #define HAVE_VSNPRINTF 1
151 Q) When I run "visudo" it says "sudoers file busy, try again later."
152 and doesn't do anything.
153 A) Someone else is currently editing the sudoers file with visudo.
155 Q) When I try to use "cd" with sudo it says "cd: command not found".
156 A) "cd" is a shell built-in command, you can't run it as a command
157 since a child process (sudo) cannot affect the current working
158 directory of the parent (your shell).
160 Q) When I try to use "cd" with sudo the command completes without
161 errors but nothing happens.
162 A) Even though "cd" is a shell built-in command, some operating systems
163 include a /usr/bin/cd command for some reason. A standalone
164 "cd" command is totally useless since a child process (cd) cannot
165 affect the current working directory of the parent (your shell).
166 Thus, "sudo cd /foo" will start a child process, change the
167 directory and immediately exit without doing anything useful.
169 Q) When I run sudo it says I am not allowed to run the command as root
170 but I don't want to run it as root, I want to run it as another user.
171 My sudoers file entry looks like:
173 A) The default user sudo tries to run things as is always root, even if
174 the invoking user can only run commands as a single, specific user.
175 This may change in the future but at the present time you have to
176 work around this using the 'runas_default' option in sudoers.
178 Defaults:bob runas_default=oracle
179 would achieve the desired result ofr the preceding sudoers fragment.
181 Q) When I try to run sudo via ssh, I get the error:
182 sudo: no tty present and no askpass program specified
183 A) ssh does not allocate a tty by default when running a remote command.
184 Without a tty, sudo cannot disable echo when prompting for a password.
185 You can use ssh's "-t" option to force it to allocate a tty.
186 Alternately, if you do not mind your password being echoed to the
187 screen, you can use the "visiblepw" sudoers option to allow this.
189 Q) How do you pronounce `sudo'?
190 A) The official pronunciation is soo-doo (for su "do"). However, an
191 alternate pronunciation, a homophone of "pseudo", is also common.