0

I am using Amazon's AWS insances running CentOS. I was trying to create a user with SUDO privilege and then disable the Root login to secure the systems. I have already done the required to bring this into effect but am now stuck with a problem I failed to understand.

When I created a User (say ABC) I did not set a password for it. Instead I use RSA Keys for authentication purpose.

Then I used visudo command and added ABC ALL=(ALL) ALL to the bottom of the file to give sudo privilege to this user.

Then I opened /etc/ssh/sshd_config in vi and turned PermitRootLogin to no and restart sshd. this is to disable root access.

I was expecting this to be it, i.e. disabling root login and having ABC do all the required administrative task. But am badly stuck now.

My Problem is when I login a ABC and try to sudo any command, it is asking for user passsword. This user does not have a password but a RSA Key with it, which i dont think can be used with SUDO.

I tried setting a password for this user using passwd command. Thats does not work either. Am getting following error.

$ passwd
Changing password for user kagzisa.
Changing password for kagzisa
(current) UNIX password:
passwd: Authentication token manipulation error

I am just pressing enter key when it prompts for current password as there is no current password specified.

Now I am stuck as I have got the Root login disabled and am not able to sudo any commands from ABC. I cant loose this system as there are some important process running on it.

Is there a way through which I can fix this. Either by reactivating root or by able to sudo commands?

  • I believe this question is for [superuser.com](http://superuser.com/) –  Oct 24 '11 at 08:18

3 Answers3

0

First of all become root.

As root you don't need to know any password to change it:

# passwd kagzisa
Enter new UNIX password:
Ra_
  • 677
  • 4
  • 9
0

You may need to install a package pam_ssh_agent_auth (available for Centos 7), then use /etc/pam.d/sudo to accept it as an authorization as ABC if you have permissions Finally, you may need to add SSH_AUTH_SOCK to the list of environment variables that persist during sudo.

Or use Nopassword as recommended earlier. Other wise bring up new machine detach ebs and attach to new ec2 if downtime can be afforded

Amrit Pal Singh
  • 16
  • 3
0

You should probably use NOPASSWORD tag in visudo so it won't ask you for any password. ABC ALL = NOPASSWD: ALL

Michael
  • 1