I have Ubuntu 8.04 LTS machine and Windows 2003 AD domain.

I have succesfully set up that I can log in with domain username and password, using domain prefix, like "domain+username".

Upon login to machine it all works first try, however, for some reason when I try to sudo my logged in user, it asks for the password twice every time when I try sudo. It accepts the password after 2nd time, but not the first time.

Once or twice I might think I just keep entering wrong pass the first time, but this is what happens always, any ideas of what's wrong?

pam.conf is empty pam.d/sudo only includes common-auth & common-account, and

common-auth is:

auth    sufficient      pam_unix.so nullok_secure
auth    sufficient      pam_winbind.so
auth    requisite       pam_deny.so
auth    required        pam_permit.so
  • note, that according to Samba documentation there are two similar options, which appear to do DIFFERENT things: use_first_pass Do not prompt the user for passwords; take them from PAM_ items instead. try_first_pass Try to get the password from a previous PAM module; fall back to prompting the user. – Gnudiff Jan 10 '11 at 13:17

in PAM there is an option called "use_first_pass" :

auth        sufficient    pam_ldap.so use_first_pass

try enabling it for ldap, should fix your issue

| improve this answer | |
  • 1
    it appears that use_first_pass does something different? should it be try_first_pass? – Gnudiff Jan 10 '11 at 13:15

Try to change this line:

auth    sufficient      pam_winbind.so


auth    sufficient      pam_winbind.so try_first_pass
| improve this answer | |

I have the same problem and removing:

auth sufficient pam_unix.so nullok

from /etc/pam.d/common-auth and adding:

auth sufficient pam_ldap.so use_first_pass

solved the problem :-).

| improve this answer | |

Besides from being an Ubuntu 14.04 installation, I had this same problem, which started after a failed sudo apt-get update && sudo apt-get upgrade attempt in which I had to turn off the machine in the middle of the upgrade. Although in my case /etc/pam.d/sudo had:

@include common-auth
@include common-account
@include common-session-noninteractive

I just commented out @include common-session-noninteractive (i.e: adding a # in front of that line, like # @include common-session-noninteractive) and now everything is back to normal asking only once for the password when using sudo. So far so good. Hope this helps!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.