I've configured a server to support OTP (using opie) with ssh. What annoys me is that I get the OTP passphrase prompt even for root when doing sudo. How can I configure PAM to suppress it? Don't see a need for OTP locally.

System is Debian stable (lenny), with minor unstable/backports installed (nothing connected to PAM).


I'm not sure if this is "the Debian way" to do it, but:

You should have an /etc/pam.d/sudo file which specifies which PAM modules sudo will use for authentication (and other stuff) -- Find the module for your one-time password magic and comment it out. The lines you're looking for probably look something like:

auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local

On Debian systems a lot of PAM configurations reference common-* files -- If that's the case copy the contents of those files in place of the include directive.

Sage advice: Launch screen & su to root inside it before you start editing so you have a root shell to fix stuff if you need it; Also obviously make a backup of the original file so you can get it back if you need to.

  • If the sudo pam configuration isn't in /etc/pam.d or /usr/local/etc/pam.d you can also try locate sudo | grep -i pam -- That shouldn't be a huge list & should have the file you're looking for :)
    – voretaq7
    Feb 18 '10 at 15:58
  • Thanks! Yes, that's it, though I'm looking into moving opie into sshd (as that's where it's actually required). Feb 18 '10 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.