Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In our environment we do not join Linux boxes to the Microsoft Domain. We do however setup Kerberos. This allows us to log into the boxes using our AD credentials as long as there is a local account with the same name. However, when I use sudo it only accepts my local credentials. How can I use my AD password with sudo? Thanks.

share|improve this question
How exactly did you "setup Kerberos"? – Michael Hampton Feb 27 '14 at 14:44
Just created a krb5.conf file – Chris Jones Feb 27 '14 at 15:04
did you configured /etc/pam.d/sudo to use distro are you using? – c4f4t0r Feb 27 '14 at 15:06
Hmm I'll have to check. Good point. – Chris Jones Feb 27 '14 at 15:08
@ChrisJones i missed you are using redhat, try with authconfig --enablekrb5 --updateall – c4f4t0r Feb 27 '14 at 15:33
up vote 2 down vote accepted

Seems like it's a PAM configuration issue. I have a similar setup on our Linux servers---Kerberos authentication against our AD DCs.

Below are the relevant PAM files for comparison.

First, system-auth PAM config which the sudo config depends on:

# cat /etc/pam.d/system-auth
auth        required
auth        sufficient
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        sufficient use_first_pass
auth        required

account     required broken_shadow
account     sufficient
account     sufficient uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore]
account     required

password    requisite try_first_pass retry=3 type=
password    sufficient md5 shadow nullok try_first_pass use_authtok
password    sufficient use_authtok
password    required

session     optional revoke
session     required
session     [success=1 default=ignore] service in crond quiet use_uid
session     required
session     optional

As you could see, this includes the module used for Kerberos.

The sudo PAM config files include system-auth and look like this:

# cat /etc/pam.d/sudo
auth       include      system-auth
account    include      system-auth
password   include      system-auth
session    optional revoke
session    required

# cat /etc/pam.d/sudo-i
auth       include      sudo
account    include      sudo
password   include      sudo
session    optional force revoke
session    required

PAM could be very powerful but it took me a bit to get my head wrapped around it. Red Hat's documentation helped me out a lot when dealing with PAM issues.

share|improve this answer
All this is fine, but you really need to have a host keytab on the machine. If you don't then the security of kerberos is compromised and can be spoofed with MITM attacks. – Fred the Magic Wonder Dog Mar 25 '14 at 14:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.