I have a fabric deployment script which uses sudo heavily. It runs about 20 commands using sudo without any problems and then choke on the last two commands:
ln -sf /path/a /path/b
chown -R someuser:somegroup /path/a
When my script tries to run one of these commands, I get the sudo password prompt (even though the script already used sudo about 20 times just before without asking for it).
Now if I ssh to the server and type the command with sudo, I get the same result. It prompts me for the my password. The problem is that it never accept it.
So if I type sudo with any other commands it works. But with these two commands it keeps asking me for my password and refuse it saying "Sorry, try again.". However if I log in as root with su and type the same command it works.
So the password is correct and sudo works (except for those two commands) and this is not related to fabric .. I'm out of ideas.
My sudoers conf looks like this:
root ALL=(ALL) ALL
myuser ALL=(ALL) ALL
I don't know where to look anymore.
ls -l output:
Matching Defaults entries for myuser on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User myuser may run the following commands on this host:
(ALL) ALL
Update
With some help from the CPanel tech support, I'm narrowing down the source of my problem..
The source of the problem seems to be CPHulk, a CPanel brute force protection module.
Since this module as an IP whitelist setting, I've added my IP to it. But it didn't solve my problem since CPHulk doesn't seem to see my IP:
$ tail -f /usr/local/cpanel/logs/cphulkd.log
[info] Connection service=system ip= port=0 user=myuser blocked by cphulkd (Too many failures for this username numfailed=17 max=15)
Notice the "ip" field is blank. I've seen other users getting blocked and their IP is always displayed.
Now I guess I'll have to find out why CPHulk doesn't see my IP..
Update 2
According to the CPanel it's not possible to whitelist by username, so I'm pretty much stuck.
The only possible workaround I've found is to disable CPHulk before running the script and reactivate it after.
By chance, my deployment script support hooks which can run command before and after the deployment is done. So I only have to associate these two commands to the right hook:
/usr/local/cpanel/bin/cphulk_pam_ctl --disable
# Usual deploy script here
/usr/local/cpanel/bin/cphulk_pam_ctl --enable
