Setting sudo password different from login password

authenticationpamsudo

I am attempting to use PAM to use a different password for sudo than I do for logging in.

I worked off of this post originally

Set sudo password differently from login one

Unfortunately, every time I do this I end up with an authentication error and I'm not sure what is going wrong. Perhaps I am hashing my password incorrectly or adding to the database incorrectly but I am unsure of what the problem is.

The configuration for sudo reads

session    required   pam_env.so readenv=1 user_readenv=0

session    required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0

auth required pam_userdb.so crypt=crypt db=/var/local/sudopass/passwd.db

\#@include common-auth

@include common-account

@include common-session-noninteractive

I set the password using passwd -m des password for testing purposes and then use db5.3 to create the database passwd.db

db5.3_load -h /var/local/sudopass -t hash -T passwd.db

my_username

73o8ECeyEW3Y2 (password hash)

And then authentication error. Note, when I place this database in say my home directory, then PAM can't even find the database no matter how I set the permissions.)

Current auth.log dump

I'm having problems getting it to give me the authentication error but here is the current problem in auth.log
Oct 18 12:07:43 az-GlAdOS-mk11-m sudo: pam_userdb(sudo:auth): Verify user az' with a password

Oct 18 12:07:43 az-GlAdOS-mk11-m sudo: pam_userdb(sudo:auth): user_lookup: could not open database `/var/local/sudopass/passwd.db': No such file or directory

Oct 18 12:07:43 az-GlAdOS-mk11-m sudo: az : PAM authentication error: Error in service module ; TTY=pts/4 ; PWD=/home/az ; USER=root ; COMMAND=/bin/nano /etc/pam.d/sudo`

Best Answer

The guide you linked to is from 5 years ago. PAM doesn't use DES anymore. Try using this to generate your password hash:

echo pass|mkpasswd -s -m sha-512
Related Question