Unable to get sudo lecture working on CentOS 7 server

Question

I'm trying to enable the sudo lecture every time someone executes sudo, but I can't seem to get it working at all.

I found a similar question here, in which someone states that if you don't see any results when executing strings /usr/bin/sudo | grep -A4 -i "lecture", then sudo lecture isn't enabled, and I don't see any results, so now I'm trying to enable it.

I created a /etc/sudoers.d/lecture file with the following content:

Defaults        lecture = always
Defaults        lecture_file = /etc/sudoers.lecture

And made sure my /etc/sudoers file included the /etc/sudoers.d directory. Heres the content of my sudoers file:

Defaults    requiretty
Defaults   !visiblepw
Defaults    always_set_home
Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
root    ALL=(ALL)       ALL
%wheel  ALL=(ALL)       NOPASSWD:ALL
#includedir /etc/sudoers.d

I was thinking the # in front of the includedir was commenting it out, but when I "uncommented" it, I got an error whenever I would sudo. So after looking in the manual, I found this line:

Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)

So apparently the # is NOT a comment... weird.

So now that the /etc/sudoers.d/lecture file references /etc/sudoers.lecture, I created that, with a simple "Hello World" as its only contents.

However, I still don't see any lecture when I sudo, and still don't see any lecture string in strings /usr/bin/sudo ... I've gotta be doing something wrong, I just can't find it.

Any help is appreciated, thanks!

Answer 1

The sudo man page reveals nothing regarding the combined behavior of lecture = always and NOPASSWD.

If a user is required to enter his password, and lecture=always, then the lecture will be display before the password prompt. Perhaps because the lecture appears before the password prompt, if there's no prompt, there's no lecture.