Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've configured a server to support OTP (using opie) with ssh. What annoys me is that I get the OTP passphrase prompt even for root when doing sudo. How can I configure PAM to suppress it? Don't see a need for OTP locally.

System is Debian stable (lenny), with minor unstable/backports installed (nothing connected to PAM).

share|improve this question
up vote 2 down vote accepted

I'm not sure if this is "the Debian way" to do it, but:

You should have an /etc/pam.d/sudo file which specifies which PAM modules sudo will use for authentication (and other stuff) -- Find the module for your one-time password magic and comment it out. The lines you're looking for probably look something like:

auth            sufficient             no_warn no_fake_prompts
auth            requisite       no_warn allow_local

On Debian systems a lot of PAM configurations reference common-* files -- If that's the case copy the contents of those files in place of the include directive.

Sage advice: Launch screen & su to root inside it before you start editing so you have a root shell to fix stuff if you need it; Also obviously make a backup of the original file so you can get it back if you need to.

share|improve this answer
If the sudo pam configuration isn't in /etc/pam.d or /usr/local/etc/pam.d you can also try locate sudo | grep -i pam -- That shouldn't be a huge list & should have the file you're looking for :) – voretaq7 Feb 18 '10 at 15:58
Thanks! Yes, that's it, though I'm looking into moving opie into sshd (as that's where it's actually required). – Jürgen A. Erhard Feb 18 '10 at 16:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.