☰

我无法再运行 sudo 命令 - 密码不被接受

tag-icon • tag-icon sudo password
我无法再运行 sudo 命令 - 密码不被接受

我有一台运行 Ubuntu 的服务器，已经上线一年多了。我使用自己的用户（不是 root）并使用 SSH 密钥（无密码登录）通过 SSH 连接到服务器。该用户是 sudoers 的一部分，我经常使用su.这从一开始就运作良好。我的用户密码保存在密码管理器中 - 我从不手动输入任何内容。

自本月初以来，我的密码不再被接受。当我尝试运行时：

$ sudo -i
[sudo] password for my_user:
Sorry, try again.

3次尝试后：

sudo: 3 incorrect password attempts

密码没有改变。我正在粘贴正确的密码。我什至尝试从密码管理器手动复制密码。所以还有其他事情发生。

我已经检查过我仍然是 sudoers 组的成员。我检查过驱动器未满或CPU过载。没有什么异常。我确实运行自动更新，因此只需运行 Ubuntu Server 的自动更新脚本就可以安装新软件。运行 Ubuntu 22.04。

当我尝试通过运行更改我自己的用户密码时：

$ passwd my_user
Changing password for my_user.
Current password:
passwd: Authentication token manipulation error
passwd: password unchanged

所以问题似乎不在于 sudo 本身，而在于我的用户身份验证。

鉴于我无法以 root 身份运行任何内容，因此我无法检查我想要检查的所有内容。

我确实检查了一些更多的事情这个问题， 包括：

  • 根据以下规定，文件系统不是以只读方式安装的/proc/mounts
  • /etc/shadow拥有权限-rw-r-----并属于root:shadow

sudo -l 的输出：

$ sudo -l
Matching Defaults entries for my_user on lla_server:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User my_user may run the following commands on lla_server:
    (ALL : ALL) ALL

$ grep passwd /etc/nsswitch.conf
passwd:         compat systemd

$ cat /etc/pam.d/sudo
#%PAM-1.0

# Set up user limits from /etc/security/limits.conf.
session    required   pam_limits.so

session    required   pam_env.so readenv=1 user_readenv=0
session    required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0

@include common-auth
@include common-account
@include common-session-noninteractive

$ cat /etc/pam.d/sudo-i
#%PAM-1.0

# Set up user limits from /etc/security/limits.conf.
session    required   pam_limits.so

session    required   pam_env.so readenv=1 user_readenv=0
session    required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0

@include common-auth
@include common-account
@include common-session

$ su - my_user
Password: 
su: Authentication failure

$ cat /etc/pam.d/common-auth
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    [success=1 default=ignore]  pam_unix.so nullok
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional            pam_cap.so 
# end of pam-auth-update config

我可以检查哪些内容，或者什么可能导致此问题？请记住，我不能以 root 身份执行任何操作，因此我无法检查例如/var/log/auth.log。

相关内容