Wednesday, July 12, 2023

Always Type Your Sudo Password

Here's a fun one.

You're working on your machine, life is good, everything normal.

You type some command that uses sudo and it asks for your password. You decide you actually don't want to run the command, and you cancel it with Ctrl+C. Maybe you do this a few more times.

Suddenly, you decide you actually do want to run the command, so you type it out again, with sudo and you enter your password and...it rejects you.

You know your password is correct, you're absolutely sure. You even change your password to 12 to make sure you can't mis-type it.

Nope still blocked.

Congratulations, you messed up!

Well sort of. On Linux, sudo works with pam to manage your user-switching attempts. pam is configured by default via /etc/security/faillock.conf which will lock an account if 3 bad passwords are entered in the span of 15 minutes. It seems like a recent change means that even "not entering" a password counts as entering a "bad password" now, so you will be locked and the error message is the same as when the password is wrong so you are none the wiser.

What you need to do, assuming you have normal root access, is switch to root and run faillock --user ${USER} --reset which will clear out the locked sessions for your user if they exist. Then you'll need to re-login to your desktop session. Loads of fun with this one the past hour - thanks sudo!


Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================