Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Ubuntu 8.04 LTS machine and Windows 2003 AD domain.

I have succesfully set up that I can log in with domain username and password, using domain prefix, like "domain+username".

Upon login to machine it all works first try, however, for some reason when I try to sudo my logged in user, it asks for the password twice every time when I try sudo. It accepts the password after 2nd time, but not the first time.

Once or twice I might think I just keep entering wrong pass the first time, but this is what happens always, any ideas of what's wrong?

pam.conf is empty pam.d/sudo only includes common-auth & common-account, and

common-auth is:

auth    sufficient      pam_unix.so nullok_secure
auth    sufficient      pam_winbind.so
auth    requisite       pam_deny.so
auth    required        pam_permit.so
share|improve this question
    
note, that according to Samba documentation there are two similar options, which appear to do DIFFERENT things: use_first_pass Do not prompt the user for passwords; take them from PAM_ items instead. try_first_pass Try to get the password from a previous PAM module; fall back to prompting the user. –  Gnudiff Jan 10 '11 at 13:17
add comment

3 Answers

up vote 3 down vote accepted

in PAM there is an option called "use_first_pass" :

auth        sufficient    pam_ldap.so use_first_pass

try enabling it for ldap, should fix your issue

share|improve this answer
    
it appears that use_first_pass does something different? should it be try_first_pass? –  Gnudiff Jan 10 '11 at 13:15
add comment

Try to change this line:

auth    sufficient      pam_winbind.so

to

auth    sufficient      pam_winbind.so try_first_pass
share|improve this answer
    
Just to check: this won't make sudo asking for password twice, if I have to login with local account? –  Gnudiff Jan 10 '11 at 13:11
    
try_first_pass means try the password, and prompt if it fails. use_first_pass is more appropriate here. bugs.debian.org/cgi-bin/bugreport.cgi?bug=490210 –  giant_squid Jan 10 '11 at 20:33
add comment

I have the same problem and removing:

auth sufficient pam_unix.so nullok

from /etc/pam.d/common-auth and adding:

auth sufficient pam_ldap.so use_first_pass

solved the problem :-).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.