sudo authentication
high on-server
What it inspects
The auth stack for the `sudo` PAM service, read from /etc/pam.d/sudo and the files it includes (common-auth on Debian/Ubuntu, system-auth on RHEL family). The check fails when a `sufficient` pam_permit.so is reached, or when pam_permit is the only module, before a real module such as pam_unix.so. It passes for local passwords (pam_unix) or a directory backend (pam_sss and similar).
Why it matters
pam_permit.so approves every request. If it appears as a sufficient auth module for sudo, any local user allowed to run sudo becomes root without any authentication, whatever sudoers says. This usually comes from a hand-edited PAM file or a bad configuration-management template rather than a distro default.
How to verify
sudo grep -nE 'pam_permit|^@include|^auth' /etc/pam.d/sudo /etc/pam.d/common-auth /etc/pam.d/system-auth 2>/dev/nullHow to fix
Find and remove any `auth sufficient pam_permit.so` line, make sure pam_unix.so (or pam_sss.so) authenticates first, and test sudo from a second session.
Remove the permissive PAM line without breaking sudo needs your judgement
Any distro
# Editing PAM can lock you out of sudo. Keep a root shell open (or console access) until you have tested.
# 1. Find the offending line:
# grep -rn 'pam_permit' /etc/pam.d/sudo /etc/pam.d/sudo-i /etc/pam.d/common-auth /etc/pam.d/system-auth /etc/pam.d/password-auth 2>/dev/null
# 2. Delete only lines of the form `auth sufficient pam_permit.so` (or `auth [success=done ...] pam_permit.so`).
# Do NOT remove the normal `auth required pam_permit.so` that Debian places after `pam_deny.so`
# in common-auth; that one is part of a correct stack.
# 3. Confirm a real module comes first: `auth ... pam_unix.so` (local passwords) or `pam_sss.so` (directory).
# 4. On Debian/Ubuntu, `pam-auth-update --force` regenerates /etc/pam.d/common-auth from the packaged profiles
# and discards hand edits to it; review the profiles it shows before confirming.
# 5. From a second session run `sudo -k && sudo true`: it must ask for a password.