Lion server corrupted sudo: 3 incorrect password attempts
A couple of weeks ago I noticed that I was having a problem with sudo on my Lion Server, I went back as far as I could in Time Capsule and restored the entire OS, but the problem seems to have been there since the original install a few months ago. Sudo works fine on my MacBook Pro with Lion 10.7.4 Client.
I have been using sudo for years, and I've never had this happen.'
$ sudo echo
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
Sorry, try again.
sudo: 3 incorrect password attempts
( 0 ) I can log out as system admin, and log in as root with no problems, but sudo at the Terminal always fails
( 1 ) I have turned off access to root, restarted, turned it back on umpteen times
( 2 ) downloaded an re-installed Lion Server Combo 10.7.4
( 3 ) ran Norton Anti Virus, found no problems
( 4 ) looked at /etc/sudoers using visudo and it looks normal
( 5 ) I am the sys-admin for the server and $id shows that I am in the admin group
( 7 ) Server.app -> Menubar -> Tools -> Directory Utility -> Edit -> Disable Root User
( 8 ) Re-Boot
( 9 ) Server.app -> Menubar -> Tools -> Directory Utility -> Edit -> Enable Root User
( 10 ) Server.app -> Menubar -> Tools -> Directory Utility -> Select my shortname on the left scrolling area, delete Authentication Authority from right side display of my record, then save, quit, and re-boot.
( 11 ) Enter the requested old and new passwords when booting to restore the Authentication Authority
Any ideas other than the http://support.apple.com/kb/HT1528 notes on how to turn it on/off
Most everything I have done on the lion server has not required me to use sudo, but I use it frequently on osx lion client with no problems.
Something is either corrupted, or somebody forgot to turn it on ?
I hope I can get this fixed, I sure don't want to have to re-install the server software.
Thanks for any insights,
Bill Hernandez
Plano, Texas
I can su to root, but not sudo...
$ sudo echo
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
Sorry, try again.
sudo: 3 incorrect password attempts
myHost:~ usershortname$ su root -c 'tail -30 /var/log/secure.log'
Password:
May 28 21:36:44 myHost su[1426]: in od_record_check_pwpolicy(): retval: 0
May 28 21:36:44 myHost su[1426]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:36:44 myHost su[1430]: usershortname to root on /dev/ttys000
May 28 21:37:41 myHost su[1442]: in pam_sm_authenticate(): authentication failed
May 28 21:37:46 myHost su[1442]: in pam_sm_acct_mgmt(): The group check succeeded.
May 28 21:37:46 myHost su[1442]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:37:46 myHost su[1442]: in od_record_check_pwpolicy(): retval: 0
May 28 21:37:46 myHost su[1442]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:37:46 myHost su[1446]: usershortname to root on /dev/ttys000
May 28 21:37:57 myHost login[1454]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:37:57 myHost login[1454]: in od_record_check_pwpolicy(): retval: 0
May 28 21:37:57 myHost login[1454]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:38:04 myHost com.apple.SecurityServer[44]: Succeeded authorizing right 'system.services.directory.configure' by client '/System/Library/CoreServices/Directory Utility.app' [1003] for authorization created by '/System/Library/CoreServices/Directory Utility.app' [1003]
May 28 21:38:04 myHost com.apple.SecurityServer[44]: Succeeded authorizing right 'system.preferences' by client '/System/Library/CoreServices/Directory Utility.app' [1003] for authorization created by '/System/Library/CoreServices/Directory Utility.app' [1003]
May 28 21:38:09 myHost sudo[1485]: usershortname : 3 incorrect password attempts ; TTY=ttys000 ; PWD=/Users/usershortname ; USER=root ; COMMAND=/bin/echo
May 28 21:38:19 myHost su[1491]: in pam_sm_authenticate(): authentication failed
May 28 21:38:23 myHost su[1491]: in pam_sm_acct_mgmt(): The group check succeeded.
May 28 21:38:23 myHost su[1491]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:38:23 myHost su[1491]: in od_record_check_pwpolicy(): retval: 0
May 28 21:38:23 myHost su[1491]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:38:23 myHost su[1494]: usershortname to root on /dev/ttys000
May 28 21:38:39 myHost login[1502]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:38:39 myHost login[1502]: in od_record_check_pwpolicy(): retval: 0
May 28 21:38:39 myHost login[1502]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:38:48 myHost sudo[1533]: usershortname : 3 incorrect password attempts ; TTY=ttys000 ; PWD=/Users/usershortname ; USER=root ; COMMAND=/bin/echo
May 28 21:38:58 myHost su[1537]: in pam_sm_authenticate(): authentication failed
May 28 21:39:03 myHost su[1537]: in pam_sm_acct_mgmt(): The group check succeeded.
May 28 21:39:03 myHost su[1537]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:39:03 myHost su[1537]: in od_record_check_pwpolicy(): retval: 0
May 28 21:39:03 myHost su[1537]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:39:03 myHost su[1540]: usershortname to root on /dev/ttys000
myHost:~ usershortname$
Did you mean that support document?
Open Terminal.app (Applications > Utilities) and paste the two lines to the Terminal. Hit ENTER and insert your admin password (it dond't show any output to the Terminal, so just type blind and hit ENTER. AND you also have to had set a password, it won't work with a blank password).
If the first command was successfull it would print "not loaded" and return to a new line, ending on $. Then enter the second command, and hit enter.
If the first command fails, copy and paste the output here to the discussions.
Similar Messages
-
My daughter's ipod touch is locked due to too many incorrect password attempts (thanks to her little brother). It is displaying the red bar that states ipod is disabled connect to itunes. Problem is we don't have the computer that the ipod was originally synced with and she doesn't want to reset the ipod. In this instance we know the password.. so is there anyway to get the ipod to ask us one more time to enter the password? I'm not sure how many incorrect attempts were made, but it doesn't state anything about try again in so many minutes.. help, please!
No. Start with the last paragraph of:
Disabled
Place the iOS device in Recovery Mode and then connect to your computer and restore via iTunes. The iPod will be erased.
iOS: Forgot passcode or device disabled
If recovery mode does not work try DFU mode.
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings
For how to restore:
iTunes: Restoring iOS software
To restore from backup see:
iOS: Back up and restore your iOS device with iCloud or iTunes
If you restore from iCloud backup the apps will be automatically downloaded. If you restore from iTunes backup the apps and music have to be in the iTunes library since synced media like apps and music are not included in the backup of the iOS device that iTunes makes.
You can redownload most iTunes purchases by:
Downloading past purchases from the App Store, iBookstore, and iTunes Store
If problem what happens or does not happen and when in the instructions? When you successfully get the iPod in recovery mode and connect to computer iTunes should say it found an iPod in recovery mode.
If you previously synced to the computer then you may be able to recover use of the iPod without erasing the iPod by following the instructions here:
Disabled Recovery-must use syncing computer. -
Can you still configure your device to erase itself after ten consecutive incorrect password attempts if you can't unlock the screen due to forgotten passcode?
No.
-
Settings to lock phone after incorrect password attempts?
Where can I find the settings to lock my phone after a series of incorrect password attempts?
That is related to google if I remember correctly,and to unlock you need to either wait for 30 seconds ->1 minute or recover with your gmail account. However, I haven't noticed this on my Z1,it didn't offer me the option to recover with gmail.
-
Mountain lion server won't take my password for install
I have never run a server version of apple software. I am wanting web sharing to host a small website. This option was removed from sharing preferences in mountain lion.
I purchased server to avoid the need to use the command line interface. It was requiring a password and I don't use a password on my system and it wouldn't take a null. I am finding a similar problem with attempting to install server on mountain lion.
When I run the mountain lion server installer it prompts for an administrator password. I hit return as I set up the system without an administrator password. This fails, but works with all other admin password requests for software installation.
Any assistance would be appreciated.
Best Regards,
David FinellI just decided to setup passwords. I just wanted to avoid the pain. It worked. Now to figure out how to share folders over the web in server.
-
How to use Lion Server Profile Manager to require password after screensaver
Our Company is upgrading to Lion server. One of our requirments for network security is to require a password to wake the computer from sleep or screensaver. In SL Server you would add a key to the com.apple.screensaver entery in workgroup manager.
In Profile Manager in Lion server there is a custom setting section and I have tried adding a key there but it does not seem to work. Can anyone offer some help on how to put the require password to wake from sleep or screensaver in Profile Manager so the setting gets pushed out?Hi CodyCodes,
Just discovered the same issue today as well. Further complicating things, the screensaver timeout setting in Login Window doesn't apply to Profile Manager clients no matter what the setting. This was reproduced and confirmed by the Apple Tech I was working with. He's submitted the bug to their engineering staff. I requested that he ask them why there is no setting for password on sleep or screensaver. Hopefully this is resolved soon, as this feature is 99% of the reason we're implementing Profile Manager to begin with.
Cheers -
Need help to reset iPad password settings due to wrong password attempts, have not sync with iTunes
It appears you will need to contact Apple Support who are able to reset your account details.
Click the link below and select the country you are in:
Apple Support -
Incorrect password attempts enforced
Hi All,
I have activesync policy set on exchange 2007 to enforce 10 failed password attempts, however on my IOS devices, the policy enforced turns to 5 when exchange account is setup.
Any ideas?seems like a activesync problem, android phones are getting the same policy, my exchange admin refreshed something and the correct password attempts is shown now.
cheers -
Corrupted .rar file / incorrect password (help please)
hi there,
i have been sent several .rar video files and usually have no problem expanding them. i generally use Rar Expander and UnrarX. this time however, half-way through the expansion, it always stops, saying the password is incorrect or the file is corrupted. whilst it is being expanded i can watch the file up until the half-way point by locating it in finder. my mate has constantly tried uploading and sending me the file that seems to be corrupted but it's always the same issue. is there a way i can start the expansion after the corrupted file so i can see the other half of the file or expand each file individually. i also have VLC Rar Loader but for some reason I can't open this individual files in this either. please help, i would greatly appreciate.
thanks in advance, ravi.Consecutive rar files cannot be opened individually. So if you have 10 .rar files, and the 5th one is broken, you can only view items in .rar files 1~4, and parts of 5 if you're lucky.
Sorry, but that's how split compression works. You miiight be able to fix it using some special tool, but I don't know of any that works if the resulting file is supposed to be one giant video file.
In all honesty, you would be better off re-downloading from their origins. -
Sudo fails after password change
I've been fighting with sudo for some while now. The cause is, it won't accept any password from accounts that I've made changes to it's passwords lately. Though, editing sudoers to gain root acess without passwords works ok.
I really don't know what to look for, tryed basic stuff like reinstalling sudo and messing with visudo, but nothing really promising (except for the "without password" bit).
Hope for some light from you, expert archers. (not those with bows and arrows )Sorry for my lack of attention on this topic.
Until this problem I was using the whell group scheme, but then I tried adding my username to sudoers, but no change. Only if I activate NOPASSWD.
Mu sudoers:
# sudoers file.
# This file MUST be edited with the 'visudo' command as root.
# Failure to use 'visudo' may result in syntax or file permission errors
# that prevent sudo from running.
# See the sudoers man page for the details on how to write a sudoers file.
# Host alias specification
# User alias specification
# Cmnd alias specification
# Defaults specification
# Runas alias specification
# User privilege specification
root ALL=(ALL) ALL
adriano ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL
# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now
Which authentication method do you use?
Not sure about what you're talking about, but I think it's PAM.
Are the computers standalone, NIS, ldap?
It's just one computer with 3 users... nothing complex.
When I (user adriano) try to use sudo with this method:
$sudo echo ok
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
Senha:
Sorry, try again.
Senha:
Sorry, try again.
Senha:
Sorry, try again.
sudo: 3 incorrect password attempts
When NOPASSWD is activated:
$sudo echo ok
ok
Using Whell group gives the same result as both above
Before The password change, this "banner" would never show up if you had the right to use sudo.
Last edited by Adriano ML (2009-11-21 21:00:03) -
How to reinstall on client from Lion Server Time Machine backup?
I have a Mac Mini running Lion Server and a black MacBook running Lion. I recently needed to to perform a format and reinstall of the MacBook, so I used the MacBook's Recovery HD partition and reinstalled Lion. I then went back to Recovery HD to reinstall apps from my Time Machine backup' which is managed by the Lion Server Mac Mini. On first attempt, I saw the right files, but in the process it hung. I recently tried to do it again, and now it claims that there are no backups found.
My suspicion is that as this is a Lion Server managed backup, it bundles the server backup and the MacBook backup in the same bundle. Revovery HD looks for the latest compete bundle, then finds the matching backup for the MacBook. However, if the Mini is continuing backups of its own, the more recent bundle backups only have mini info, not the MackBook, hence they "disappeared".
I can see older backups when I look at the backup drive, so I suspect that my MacBook files are still there.
Any suggestions on how to recover and get my MacBook files reinstalled? I'm new to this home server thing, so any help would be greatly appreciated!
JasonOne partition 2.5TB will be my new Time Machine Backups and the other 2.5TB for iTunes Library so I never have to worry about this again.
Your worry now is what will you do when the single hard drive containing both your library and its backup makes a screeching sound one day and is toast, or get stolen?
from a YouTube video
Uh-oh, those unspecific and sometimes incorrect YouTube videos. I dislike those things. I watched one once and some kid droned on in a barely audible monotone for about 5 minutes to show how to do something to which I could have typed instructions in two sentences.
Downloading (using iOS or computer) past purchases from the App Store, iBookstore, and iTunes Store - http://support.apple.com/kb/ht2519 -
Hi,
Is there a way to setup a threshold for the number of incorrect password attempts during login event?
Apreciate any help on this matter!
Regards,
NawafApparently, this could be achieved through WGM tool. Once WGM is open, under accounts, you can specify "advanced" "options" to disable an account after so many failed attempts.
This rocks!
Case closed! -
My ipad air2 has been disabled due to incorrect password input
Please help me to restore my ipad air2 (4th generation) as it was disabled by entering incorrect password attempts.
FORCE IPAD INTO RECOVERY MODE
1. Turn off iPad
2. Turn on computer and launch iTunes (make sure you have the latest version of iTune)
3. Plug USB cable into computer's USB port
4. Hold Home button down and plug the other end of cable into docking port.
DO NOT RELEASE BUTTON until you see picture of iTunes and plug
5. Release Home button.
ON COMPUTER
6. iTunes has detected iPad in recovery mode. You must restore this iPad before it can be used with iTunes.
7. Select "Restore iPad"...
Note:
1. Data will be lost if you do not have backup
2. You must follow step 1 to step 4 VERY CLOSELY.
3. Repeat the process if necessary. -
Password problem after migrating to Mountain Lion Server
Hello everyone,
Yesterday, I migrated our Lion Server to Mountain Lion Server. Everything seemed to work fine. Except since this morning, none of the network user cannot connect to their calendar, reminders, and wiki. They can connect to their account and to their mails. The following line appears multiple times in ApplePasswordServer.Error.log:
Aug 16 2012 16:52:50 700250us client response doesn't match what we generated
It seems that only web services are concerned (vpn, mobile accounts, and mails are working). My initial guess is that the hash computed on the basis of the user password is not computed on the same way on the client machine (which is running Mountain Lion by the way) and on the server. On the other hand, this would be very surprising, since all this stuff is based on standards and unlikely to have changed since Lion.
I tried to create a new "Test" user. Even this new user, created after the migration, cannot connect to its calendar, etc. I also tried to reset my user password using the Server App. It makes no difference, the same lines appear in the logs.
Is anyone experiencing a similar problem ? Does anyone have a clue of what to try next ?
Thanks a lot !I found out the following:
After looking at the contents of the password server database using the slot numbers of several user accounts, it seems that all users where WEBDAV-DIGEST authentication is failing, have two entries for the digest method "*cmusaslsecretDIGEST". This is obviously wrong. All users who can authenticate successfully have only one such entry.
Deleting and recreating the user account has no effect. In fact, updating the password server with a new entry may actually trigger this error. It could be that all users where this is failing have changed their passwords after the server was updated to Mountain Lion.
It would be interesting to know if you also see duplicate entries for "*cmusaslsecretDIGEST" in the database. You can display a password server record via the user account's slot number (in your example, the 0xd6ace...) using the command
sudo mkpassdb -dump <slot-number>
At the end of the record dump, you should see 10 digest entries with their method identifiers. -
I am trying to allow guests on windows to connect to shares on my Lion server but it keeps asking for a password for guest. I have allow guest users to access this share enabled but it still does not work.
Ditto. Guest accounts shouldn't have a password. No way to enter one in System Prefs...
Maybe you are looking for
-
I made a mistake by pressing autofill on my hp windows laptop and all of my music was gone from itunes and my iphone 5s, how can i get my music back onto my iphone 5s?
-
Upgrade to 9.2.0.8 from 9.2.0.6
Hi, Is p4547809_92080_WINNT.zip the correct patch set to upgrade to 9.2.0.8 from 9.2.0.6 ? We are on Win 2003 server. DB is 9.2.0.6. Many thanks.
-
What's wrong with itunes 10.5 ??!!??
itunes 10.5 is so slow, and always in "no response" status. I cannot sync my ipad2 with itunes... I cannot back up my ipad2! "netsh winsock reset" does not work for me... I have tried to uninstall then re-install for couple times but the issues are s
-
Error occured while trying to access desktop:
Hi All, I've search all the threads I can find on here and tried everything they have suggested but to no avail. I have a customer desktop which is working in Dev/QA, it's now gone into Production and I get: Error occured while trying to access deskt
-
after installing the latest version of itunes for windows xp, i now have a letterbox effect on all my videos both old and freshly downloaded alike. Anybody have suggestions? My new imac is only weeks away!