2

I've altered my /etc/sudoers file with sudo visudo as follows (showing only uncommented lines, the entire file can be found here):

$ grep -v '^#[^i]' /etc/sudoers/ | grep .
root ALL=(ALL) ALL
%wheel ALL=(ALL) NOPASSWD:ALL
#includedir /etc/sudoers.d

Basically, I have just uncommented one line, which should disable sudo password entry for all members of the wheel group. My user is part of the wheel group as shown in the output of groups [username]:

sys lp wheel network video optical storage scanner power ruben

However, it is not working, since I have to enter a password every time I open a new terminal window. I've rebooted a couple of times already.

What am I missing?

EDIT1: id command returns: uid=1000(ruben) gid=1000(ruben) groups=1000(ruben),3(sys),7(lp),10(wheel),90(network),91(video),93(optical),95(storage),96(scanner),98(power)

Jack
  • 51
  • 6
  • 1
    welcome to U&L, is wheel your **primary** group ? does it came first if you do `id` ? – Archemar Oct 30 '18 at 15:16
  • (Typo-verification: I assume you ran `groups username` and not `group username`?) – Jeff Schaller Oct 30 '18 at 15:22
  • 1
    @JeffSchaller whoops, good point. Thanks. – terdon Oct 30 '18 at 15:25
  • I can not duplicate the problem using only modifications to `/etc/sudoers` and groups... I've tried adding a system group and a user group, eliminating the `sudo` group... Which distro are you using? And is SELinux running? Is there a group password set? ... and could you provide the output of `grep wheel /etc/group` – RubberStamp Oct 30 '18 at 16:48
  • Do you have another applicable rule in a file in `/etc/sudoers.d`? [Order matters](https://unix.stackexchange.com/questions/18830/how-to-run-a-specific-program-as-root-without-a-password-prompt). – Gilles 'SO- stop being evil' Oct 30 '18 at 19:51
  • @Archemar `uid=1000(ruben) gid=1000(ruben) groups=1000(ruben),3(sys),7(lp),10(wheel),90(network),91(video),93(optical),95(storage),96(scanner),98(power)` I never heard of the term **primary** group. I guess it is "ruben"? – Jack Nov 02 '18 at 22:43
  • @JeffSchaller You're right, fixed – Jack Nov 02 '18 at 22:46
  • @Gilles I think this is it! /etc/sudoers.d contains a file called "10-installer" containing `%wheel ALL=(ALL) ALL` which should request a password for all commands for every wheel group user. – Jack Nov 02 '18 at 22:54

1 Answers1

3

As Gilles pointed out there is a file /etc/sudoers.d/10-installer containing %wheel ALL=(ALL) ALL.

The 10-installer file is included in /etc/sudoers, after the change I made. This inclusion overwrites my change to the /etc/sudoers file.

Jack
  • 51
  • 6