Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured a server to support OTP (using opie) with ssh. What annoys me is that I get the OTP passphrase prompt even for root when doing sudo. How can I configure PAM to suppress it? Don't see a need for OTP locally.

System is Debian stable (lenny), with minor unstable/backports installed (nothing connected to PAM).

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I'm not sure if this is "the Debian way" to do it, but:

You should have an /etc/pam.d/sudo file which specifies which PAM modules sudo will use for authentication (and other stuff) -- Find the module for your one-time password magic and comment it out. The lines you're looking for probably look something like:

auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local

On Debian systems a lot of PAM configurations reference common-* files -- If that's the case copy the contents of those files in place of the include directive.


Sage advice: Launch screen & su to root inside it before you start editing so you have a root shell to fix stuff if you need it; Also obviously make a backup of the original file so you can get it back if you need to.

share|improve this answer
    
If the sudo pam configuration isn't in /etc/pam.d or /usr/local/etc/pam.d you can also try locate sudo | grep -i pam -- That shouldn't be a huge list & should have the file you're looking for :) –  voretaq7 Feb 18 '10 at 15:58
    
Thanks! Yes, that's it, though I'm looking into moving opie into sshd (as that's where it's actually required). –  Jürgen A. Erhard Feb 18 '10 at 16:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.