DynFi setup and sudo

Stewart

I'm trying to get DynFi up and running to see how it does giving us visibility into all of our devices. I do not want to supply the root login information into it and want it to have its own dynfi user. When I go to connect it to a box I get the error of:

User not permitted to run sudo WITHOUT PASSWORD. Make sure sudo is configured properly (no password for all commands).
SSH connection failed (sudo requires password)

I've given the dynfi user all permissions in the user manager but that doesn't seem to help. What should I be doing to all this? Thanks.

johnpoz

@stewart said in DynFi setup and sudo:

Make sure sudo is configured properly (no password for all commands).

That seems pretty clear.. Did you set no password for this user account in the sudoers file?

NOPASSWD: ALL

Stewart

@johnpoz I've never manually edited the sudoers file but I modified /usr/local/etc/sudoers to be

root ALL=(root)  ALL
admin ALL=(root)  ALL
dynfi ALL=(root)  ALL
%admins ALL=(root)  ALL

but that didn't work. I had thought maybe it could be a setting in the users setup but I guess I'm doing something wrong.

EDIT:
I've also tried

root ALL=(root)  ALL
admin ALL=(root)  ALL
dynfi ALL=(ALL) NOPASSWD: ALL
%admins ALL=(root)  ALL

but it doesn't work either.

johnpoz

@stewart so as this dynfi user can you sudo up to root without having to put in a password?

Stewart

@johnpoz It doesn't appear so.

/home/dynfi: sudo cat /etc/version

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

Password:

EDIT:

root ALL=(root)  ALL
admin ALL=(root)  ALL
dynfi ALL=(root) NOPASSWD: ALL
%admins ALL=(root)  ALL

Also doesn't seem to work.

Stewart

@johnpoz I got it. It worked if I made the user the last line in the file, after the %admins line. Probably because I had the user in the admins group. I then took the user out of the admins group and just gave it SSH and shell permissions and now it works no matter where I put the user in the sudousers file.

johnpoz

@stewart glad you got it sorted.. I don't really do sudo much on pfsense. But I do it it on other linux boxes and my nas.. I hate having to type my user password all the time on my nas when I want to su up to root.. Its lazy sure - but there are no hostiles on my network, its on an isolated vlan, etc. So I just let that account su up without having to reauth.