从9升级到12.04.1后，我破坏了Sudo

11

目前sudo会提示您输入密码，但此后绝对没有任何反应。没有任何错误。

我已经检查了sudoers文件，它通过了visudo语法检查，这是安装程序：

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

该文件具有0440作为权限。我已将自己添加到sudo和admin小组中。

这是我尝试使用Sudo时的样子：

kml@rhythmsdev:/etc$ sudo apt-get update
kml@rhythmsdev:/etc$

如您所见，完全没有错误。它只是返回到提示。

这是文件权限

-r--r----- 1 root root 723 Feb 1 10:10 sudoers

sudoers.d

drwxr-xr-x 2 root root 4096 Feb 4 16:46 .

这是id我要让Sudo工作的其中一个Users 的输出：

uid=1010(kml) gid=102(develop) groups=102(develop),4(adm),27(sudo),106(admin),110(ftp)

我如何执行升级。

我使用do-release-upgrade -dSSH 进行了升级，但是可以通过走廊进行物理访问。

这是/etc/sources.list的内容

    #
# deb cdrom:[Ubuntu-Server 10.04 LTS _Lucid Lynx_ - Release i386 (20100427)]/ lucid main restricted
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.

deb http://us.archive.ubuntu.com/ubuntu/ precise main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise universe
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise multiverse
deb http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ precise-updates multiverse

## Uncomment the following two lines to add software from the 'backports'
## repository.
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb http://us.archive.ubuntu.com/ubuntu/ lucid-backports main restricted universe multiverse
# deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-backports main restricted universe multiverse

## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu lucid partner
# deb-src http://archive.canonical.com/ubuntu lucid partner

deb http://security.ubuntu.com/ubuntu precise-security main restricted
deb-src http://security.ubuntu.com/ubuntu precise-security main restricted
deb http://security.ubuntu.com/ubuntu precise-security universe
deb-src http://security.ubuntu.com/ubuntu precise-security universe
deb http://security.ubuntu.com/ubuntu precise-security multiverse
deb-src http://security.ubuntu.com/ubuntu precise-security multiverse
# deb http://security.ubuntu.com/ubuntu maverick-security main universe

目录：/etc/apt/sources.list.d是空的。

lsb_release -a 是

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 12.04.1 LTS
Release:        12.04
Codename:       precise

apt-cache policy sudo 是：

sudo:
  Installed: 1.8.3p1-1ubuntu3.3
  Candidate: 1.8.3p1-1ubuntu3.3
  Version table:
 *** 1.8.3p1-1ubuntu3.3 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main i386 Packages
        100 /var/lib/dpkg/status
     1.8.3p1-1ubuntu3.2 0
        500 http://security.ubuntu.com/ubuntu/ precise-security/main i386 Packages
     1.8.3p1-1ubuntu3 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise/main i386 Packages

type -a sudo 是

sudo is /usr/bin/sudo

sha256sum $(which sudo) 是

0efd358e04ea07dc73b67642d9bb85f49143c65996a7c88a57b42557a0b0a50d /usr/bin/sudo

pkexec echo success 做过这个：

==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/echo' as the super user
Multiple identities can be used for authentication:
 1.  My Name,,, (me)
 2.  ,Account used for Git,, (git)
 3.  Coworker1,,, (cw1)
 4.  Coworker2,,, (cw2)
 5.  Coworker3,,, (cw3)
 6.  My Name,,, (me)
 7.  Coworker4,,, (cw4)
 8.  Coworker5,,, (cw5)
 9.  ,Account used for Git,, (git)
Choose identity to authenticate as (1-9): 1
Password:
==== AUTHENTICATION COMPLETE ===
success

名称已更改，以保护大多数无辜者。由于某种原因，我出现了两次。但是其他任何同事都不能使用Sudo（无论如何都可以预先升级）。

这是更多命令的输出。

visudo sudoers文件并添加 kml ALL=(ALL:ALL) ALL到根目录下

sudo -i echo success 返回与以前一样，什么也没有。

echo foo | sudo tee foo.txt; ls -l foo.txt 产生：

ls: cannot access foo.txt: No such file or directory

我如何重新安装Sudo。

我完成了两次。

我第一次跑 apt-get install --reinstall sudo-从根

这成就很少，所以我卸载首先通过： apt-get uninstall sudo后跟 apt-get install sudo

重新编辑更多信息

sudo密码验证后返回无提示，并且不再询问。 sudo -k并且sudo -K 还以静默方式失败，我以root用户身份登录，它提示您在普通帐户上输入密码。

更多信息2

我跑了 tail -f /var/log/auth.log

这是sudo ls我的kml帐户的输出

Feb  6 16:33:27 rhythmsdev sudo: pam_unix(sudo:session): session opened for user root by kml(uid=1010)
Feb  6 16:33:27 rhythmsdev sudo: pam_unix(sudo:session): session closed for user root

尝试输入错误的密码会提示您输入新密码，并将其记录下来

Feb 6 16:35:17 rhythmsdev sudo: pam_unix(sudo:auth): authentication failure; logname=kml uid=1010 euid=0 tty=/dev/pts/0 ruser=kml rhost= user=kml

版3

sudo apt-get clean && sudo apt-get update && sudo apt-get --purge --reinstall install sudo

须藤仍然不起作用。这是输出

apt-get install --purge --reinstall sudo
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  mono-2.0-gac libxcb-aux0 python-fstab libgnomekbd4 libts-0.0-0 libwpd8c2a libcdio10 xsltproc pnm2ppa librpmbuild0 libcolamd2.7.1 lp-solve libglitz-glx1 openoffice.org-writer libntfs10 python-gnome2 libxcb-render-util0 libevent-1.4-2
  gnome-media gnome-desktop-data libgtk-vnc-1.0-0 libgnomepanel2.24-cil xulrunner-1.9.2 libxcb-event1 libindicator0 linux-headers-2.6.32-38 libicu42 openoffice.org-draw libdbusmenu-glib1 ubufox python-aptdaemon-gtk openoffice.org-gtk
  libsilc-1.1-2 libgnome-media0 libbeagle1 g++-4.4 libexchange-storage1.2-3 libgraphite3 libwpg-0.1-1 libibus1 libproxy0 libnm-util1 python-gtksourceview2 libevview2 scrollkeeper libindicate-gtk2 libwebkit-1.0-2
  libmono-system-runtime2.0-cil libpisock9 libdns64 libcamel1.2-14 bcmwl-modaliases librpmio0 librpm0 libgnome2-perl libaccess-bridge-java-jni libstdc++6-4.4-dev libeggdbus-1-0 libnspr4-0d libgtkhtml-editor0 esound-common
  python-pyorbit gdebi-core libnotify1 python-telepathy libedata-cal1.2-6 libaccess-bridge-java libdevkit-power-gobject1 gnome-media-common librasqal2 libpango1.0-common ubuntuone-client-gnome cups-driver-gutenprint libgadu3
  openoffice.org-style-human libmono-cairo2.0-cil libisccc60 cpu-checker libgweather1 python-gtkspell libgnome-bluetooth7 libxxf86misc1 libloudmouth1-0 libsexy2 libxcb-atom1 libido-0.1-0 libgmime2.4-cil compiz-plugins libffi5
  libgnome-pilot2 libdirectfb-1.2-0 openoffice.org-style-galaxy libgssdp-1.0-2 libcryptui0 finger libmusicbrainz4c2a python-pyatspi libgp11-0 libjs-mootools python-webkit libgcr0 libqt4-webkit libcdio-cdda0 libhunspell-1.2-0 liblwres60
  libgmp3c2 libgtksourceview2.0-common openoffice.org-math libhal1 libgtksourceview2.0-0 hal libgnome2-vfs-perl libprotobuf5 libesd0 openoffice.org-common libegroupwise1.2-13 libdbusmenu-gtk1 libgsf-1-common gnome-doc-utils
  libecal1.2-7 at-spi libpoppler5 libgmime-2.4-2 libgdata1.2-1 libedataserver1.2-11 libhal-storage1 libpython2.6 gnome-system-monitor libmldbm-perl libbind9-60 libimobiledevice0 libgtkmm-2.4-1c2a libglitz1 libevdocument2
  libgdata-google1.2-1 libspeechd2 fglrx-modaliases libnunit2.4-cil libclutter-gtk-0.10-0 libebook1.2-9 libmagickcore2 libaudiofile0 libwps-0.1-1 libedataserverui1.2-8 nvidia-173-modaliases libphonon4 libgnome-window-settings1
  libedata-book1.2-2 libgdata6 libxss1 libgs8 openoffice.org-emailmerge libappindicator0 liblpint-bonobo0 ntfsprogs libjpeg62 libgtkhtml-editor-common libqt4-designer libmpfr1ldbl libcdio-paranoia0 libmysqlclient16 libmagickwand2
  libisccfg60 libfreezethaw-perl smartdimmer libgupnp-1.0-3 screen-resolution-extra libnl1 libanthy0 tsconf liboobs-1-4 libgucharmap7 libgksu2-0 libdb4.7 libsilcclient-1.1-3 libindicate4 libndesk-dbus-glib1.0-cil libraptor1 python-wnck
  liboil0.3 libebackend1.2-0 firefox-branding hal-info speech-dispatcher libgnome-desktop-2-17 fuse-utils python-desktopcouch gwibber libisc60 libnice0 linux-headers-2.6.32-38-generic libnautilus-extension1 compiz-fusion-plugins-main
  gnome-applets-data min12xxw libwebkit-1.0-common libavahi-ui0 libprotoc5 nvidia-96-modaliases libavahi-core6 libgupnp-igd-1.0-2 libgnome2-canvas-perl libgtkhtml3.14-19 libgsf-1-114 python-rdflib gnome-panel-data libpoppler-glib4
  libpisync1 libdotconf1.0 python-indicate
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 16 not upgraded.
Need to get 292 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main sudo i386 1.8.3p1-1ubuntu3.3 [292 kB]
Fetched 292 kB in 0s (742 kB/s)
(Reading database ... 310429 files and directories currently installed.)
Preparing to replace sudo 1.8.3p1-1ubuntu3.3 (using .../sudo_1.8.3p1-1ubuntu3.3_i386.deb) ...
Unpacking replacement sudo ...
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Setting up sudo (1.8.3p1-1ubuntu3.3) ...

编辑4

sha256sum /usr/lib/sudo/sudoers.so /usr/lib/sudo/sudo_noexec.so 结果是

6f2e56e05d9a3de942558255b72d59a147be2c637247e244c365838378fe6ec3  /usr/lib/sudo/sudoers.so
7db6a45129ec1ef6d4cb21d7a488a85f5b45e4d21990116f64c9e71f116648c0  /usr/lib/sudo/sudo_noexec.so

以其他用户的身份（以root身份运行）

root@rhythmsdev:/home/kml# sudo -u kml echo success
root@rhythmsdev:/home/kml#

编辑5

使用此处的Eliah Kagan提供的脚本，我检查了重复的组和ID。所有差异变得空白。

编辑6

strace echo success 这里

编辑7

root@rhythmsdev:/home/kml# sudo echo success
root@rhythmsdev:/home/kml# echo $?
1

编辑8

这似乎很有趣，这与具有工作sudo的服务器不同

root@rhythmsdev:/home/kml# sudo -l
Matching Defaults entries for root on this host:
    env_reset,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User root may run the following commands on this host:
    (ALL : ALL) ALL
    (ALL) ALL
root@rhythmsdev:/home/kml#

就是我

我和我一样（不是root）

kml@rhythmsdev:~$ sudo -l
[sudo] password for kml:
Matching Defaults entries for kml on this host:
    env_reset,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User kml may run the following commands on this host:
    (ALL : ALL) ALL
    (ALL) ALL
    (ALL : ALL) ALL
kml@rhythmsdev:~$

谢谢，

目前，我对想法一无所知。

12.04  upgrade  sudo 
— kevingreen
source
1
@kevingreen对不起，仍在编辑评论！也许我们应该继续聊天，因为此站点不适合讨论和长期运行的试验与错误。
— gertvdijk
它应该是一台服务器，但是我敢打赌，它最初是用GUI安装的。我们的一位管理员喜欢GUI。
— kevingreen
@EliahKagan添加了更多信息。
— kevingreen
好吧，我希望我理解这一权利。如果我sudo -u kml echo success来自非root用户，则什么也不会发生。如果我sudo -k echo success得到提示输入密码，则什么都不会发生。
— kevingreen
1
你好 请继续使用所有新信息更新您的问题。但我建议我们使用聊天。如果您同意，请加入我的聊天室。（其他有兴趣的人也可以加入我们和/或查看成绩单。）
— Eliah Kagan

Answers:

4

这是反气候的…

我可以通过更改sudoers文件中的一行来修复它。

我改变了这一行

Defaults        env_reset

然后将其更改为

Defaults        !env_reset

这是因为我注意到sudo -E正在工作。因此，我进行了一些研究，找到了防止sudo消除环境变量的方法。到目前为止，似乎已经解决了它。我需要做的是弄清楚需要保留哪个环境变量，然后用env_keep + =将其添加到其中。

谢谢您的帮助和支持，我将不断更新。在让我知道之前，我不确定是否有人建议使用sudo -E，我会将赏金授予该人。

版1

因此，我可能正在使用！env_reset创建安全问题。我会继续更新。

— kevingreen
source
0

检查您是否在管理员组中。

您也可以使用Linux CD启动应急启动并修复问题。

修改sudoers文件时，应始终使用visudo。visudo将在保存前检查sudo文件的语法，从而保护您免受此特定问题的影响（但不能编写禁止您运行sudo的sudoers文件！）

请注意，通常将sudoers设置为即使在Ubuntu上也无法写成：

-r--r----- 1 root root 600 2012-06-18 18:00 sudoers

文件保护或sudoers文件的所有权不再正确。该文件必须由以下用户拥有：root和group：root和文件保护应为：0440（u = r，g = r，o-rwx）。

chown root:root /etc/sudoers
chmod u=r,g=r,o= /etc/sudoers

chown -R root:root /etc/sudoers.d
chmod u=rwx,g=rx,o=rx /etc/sudoers.d/
chmod u=r,g=r,o= /etc/sudoers.d/*

该文件对于用户root和组root应该是只读的，对于任何人都应该是只读的。对于所有人和组根目录，该目录必须为rx，但只有用户根目录才能获得对该目录的写许可权。

— 赫尔普
source
这是权限 -r--r----- 1 root root 723 Feb 1 10:10 sudoers
— kevingreen
我肯定在Sudo and Admin组中，我已经检查过了。
— kevingreen
1
的输出id如现在在更新的问题示出了用户是的部件admin，adm和sudo基团。sudoers文件的语法看起来不错，并且与我在12.04系统上的文件相同。
— gertvdijk
1
@hhlp这些都是sudo一般而言很好的故障排除建议，在这里都值得尝试。但是，当用户不在必要的组中使用时sudo，或者当用户的任何文件sudo或文件具有错误的所有权或权限时，它不会无提示地失败（就像这里发生的那样）。
— 伊利亚·卡根
1
我故意弄乱了sudoers文件，然后尝试查看会发生什么。嘈杂地失败了，并告诉我存在语法错误。我恢复了它，然后又恢复为无声的失败。如果我在不使用sudo / admin的错误组中创建了一个用户，它将失败很大。
— kevingreen 2013年
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.