Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a fabric deployment script which uses sudo heavily. It runs about 20 commands using sudo without any problems and then choke on the last two commands:

ln -sf /path/a /path/b
chown -R someuser:somegroup /path/a

When my script tries to run one of these commands, I get the sudo password prompt (even though the script already used sudo about 20 times just before without asking for it).

Now if I ssh to the server and type the command with sudo, I get the same result. It prompts me for the my password. The problem is that it never accept it.

So if I type sudo with any other commands it works. But with these two commands it keeps asking me for my password and refuse it saying "Sorry, try again.". However if I log in as root with su and type the same command it works.

So the password is correct and sudo works (except for those two commands) and this is not related to fabric .. I'm out of ideas.

My sudoers conf looks like this:

root    ALL=(ALL)       ALL
myuser  ALL=(ALL)       ALL

I don't know where to look anymore.

ls -l output:

Matching Defaults entries for myuser on this host:
    requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",

User myuser may run the following commands on this host:
    (ALL) ALL


With some help from the CPanel tech support, I'm narrowing down the source of my problem..

The source of the problem seems to be CPHulk, a CPanel brute force protection module.

Since this module as an IP whitelist setting, I've added my IP to it. But it didn't solve my problem since CPHulk doesn't seem to see my IP:

$ tail -f /usr/local/cpanel/logs/cphulkd.log
[info] Connection service=system ip= port=0 user=myuser blocked by cphulkd (Too many failures for this username numfailed=17 max=15)

Notice the "ip" field is blank. I've seen other users getting blocked and their IP is always displayed.

Now I guess I'll have to find out why CPHulk doesn't see my IP..

Update 2

According to the CPanel it's not possible to whitelist by username, so I'm pretty much stuck.

The only possible workaround I've found is to disable CPHulk before running the script and reactivate it after.

By chance, my deployment script support hooks which can run command before and after the deployment is done. So I only have to associate these two commands to the right hook:

/usr/local/cpanel/bin/cphulk_pam_ctl --disable
# Usual deploy script here
/usr/local/cpanel/bin/cphulk_pam_ctl --enable
share|improve this question
please provide a sudo -l output –  jfried Aug 28 '12 at 18:54
I updated my post with ls -l output –  h3. Aug 29 '12 at 13:26
This question appears to be off-topic because it concerns the use of shared web hosting by end users or resellers, rather than the administration of web hosting. –  Falcon Momot Jul 2 '13 at 3:11

1 Answer 1

IF you really want no password prompting


That said I STRONGLY ADVISE replacing NOPASSWD: ALL with NOPASSWD: a,limited,subset,of,commands

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.