Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Ubuntu 8.04 LTS machine and Windows 2003 AD domain.

I have succesfully set up that I can log in with domain username and password, using domain prefix, like "domain+username".

Upon login to machine it all works first try, however, for some reason when I try to sudo my logged in user, it asks for the password twice every time when I try sudo. It accepts the password after 2nd time, but not the first time.

Once or twice I might think I just keep entering wrong pass the first time, but this is what happens always, any ideas of what's wrong?

pam.conf is empty pam.d/sudo only includes common-auth & common-account, and

common-auth is:

auth    sufficient nullok_secure
auth    sufficient
auth    requisite
auth    required
share|improve this question
note, that according to Samba documentation there are two similar options, which appear to do DIFFERENT things: use_first_pass Do not prompt the user for passwords; take them from PAM_ items instead. try_first_pass Try to get the password from a previous PAM module; fall back to prompting the user. – Gnudiff Jan 10 '11 at 13:17
up vote 3 down vote accepted

in PAM there is an option called "use_first_pass" :

auth        sufficient use_first_pass

try enabling it for ldap, should fix your issue

share|improve this answer
it appears that use_first_pass does something different? should it be try_first_pass? – Gnudiff Jan 10 '11 at 13:15

Try to change this line:

auth    sufficient


auth    sufficient try_first_pass
share|improve this answer
Just to check: this won't make sudo asking for password twice, if I have to login with local account? – Gnudiff Jan 10 '11 at 13:11
try_first_pass means try the password, and prompt if it fails. use_first_pass is more appropriate here. – hellomynameisjoel Jan 10 '11 at 20:33

I have the same problem and removing:

auth sufficient nullok

from /etc/pam.d/common-auth and adding:

auth sufficient use_first_pass

solved the problem :-).

share|improve this answer

Besides from being an Ubuntu 14.04 installation, I had this same problem, which started after a failed sudo apt-get update && sudo apt-get upgrade attempt in which I had to turn off the machine in the middle of the upgrade. Although in my case /etc/pam.d/sudo had:

@include common-auth
@include common-account
@include common-session-noninteractive

I just commented out @include common-session-noninteractive (i.e: adding a # in front of that line, like # @include common-session-noninteractive) and now everything is back to normal asking only once for the password when using sudo. So far so good. Hope this helps!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.