Catalina Sudo Issues

Question

Level 1

8 points

Catalina Sudo Issues

Hey there! I had to reset my MacBook to factory settings. I have some administrative issues with the machine now.

I use a .dotfiles repository with a bunch of settings and configs to be able to get back up and running on a new machine.

Some of these scripts require `sudo` to set system defaults for example. Now… I can't get sudo to work properly on Catalina. No matter what I do: It won't accept my password when I'm trying to use sudo on my user account.

I already have edited the sudoers file by enabling the root account. Just adding my user (ag) to the file like the following ag ALL = (ALL) ALL still does not allow me to use sudo for some reason.

It will prompt for my password, but tell me that it's incorrect when I type it in.

For manual commands I can avoid this by specifying NOPASSWD in the sudoers file but this won't work for scripts either.

I have been trying to find a solution for roughly two hours now. Maybe I'm just too stupid to use a search engine, but I couldn't find anything that's really helpful online. I really hope that someone could point me in the right direction.

Thanks,

Andreas

Posted on Jun 3, 2021 3:55 PM

Reply

Answer 1

Top-ranking reply

HWTech

Level 9

60,254 points

Jun 4, 2021 9:12 PM in response to CLTrec

I tested this on my Catalina system and got a Standard user account to have "root" privileges with and without the "NOPASSWD" option. I wouldn't expect the admin account to be any different, but I don't want to risk my only admin account right now (plus I can only access my Catalina Mac via SSH at the moment so even adding another admin user is a bit tricky). However, I did not directly modify my "sudoers" file, but instead created a new file for my "sudoers" modifications within the "/etc/sudoers.d" folder. It is a bit safer this way since the main "sudoers" file is never touched and so never accidentally damaged. For example to add custom "sudoers" settings using the file "mymods" which will be stored in "/etc/sudoers.d" you can use the following command:

EDITOR=nano  sudo  visudo  -f  /etc/sudoers.d/mymods

I suggest restoring the original default macOS "sudoers" file and add your modifications to a file within the "/etc/sudoers.d" folder instead. If you still have issues, then post the contents of that file. I'm wondering whether your modifications within the actual "sudoers" file are in the wrong location and later settings are overriding your customizations.

Reply

Answer 2

Calvin_BT

Level 3

663 points

Jun 3, 2021 5:53 PM in response to CLTrec

Have you logged in as an Admin User? Are your User Account is Admin

Make sure you've logged in as root.

In Terminal Follow this

> login
Login:root
Password:rootpassword
root> sudo visudo

ag ALL = (ALL) ALL

Reply

Answer 3

HWTech

Level 9

60,254 points

Jun 3, 2021 7:58 PM in response to CLTrec

First even with "sudo" you cannot modify any folders outside of the "/Users" folder since macOS 10.15+ now makes the system area read-only. To access those areas you need to first disable SIP (just make sure to re-enable SIP afterwards), but I don't recommend this option.

If you are using an admin account, then something else is wrong since an admin user account will allow you to use "sudo" except for making modifications to the system area as I just described.

You should be able to run this command to become root (you will get a "#" prompt, only use this to test to make sure "sudo" is working):

sudo  su  -

What type of scripts are you trying to run? Bash, zsh, Python, other?

What is the exact error message you receive when attempting to issue a command using "sudo"? Use my example command for getting a root prompt as that command should just work with a clean install of macOS when using an admin user account.

How did you restore your Mac? Exactly what steps did you use? Did you perform a clean install of macOS by first erasing the whole physical drive instead of just erasing an APFS volume? Unfortunately beginning with macOS 10.13+ Disk Utility defaults to hiding the physical drives from view so you must click "View" within Disk Utility and selecting "About This Mac" so that the physical drive appears on the left pane of Disk Utility. If you did not perform a clean install, then this may be contributing to your problem.

Did you migrate or restore from a backup? Did you try using "sudo" before migrating or restoring macOS from backup?

Reply

Answer 4

CLTrec Author

Level 1

8 points

Jun 4, 2021 12:23 AM in response to HWTech

Hi, thank you for your detailed answer.

I did a complete reset. I have wiped the entire disk through the recovery system including all partitions and then did a clean install of Catalina. I would assume that this would not result in any issues with the system itself. I was using sudo without any issues a lot before the reset.

sudo itself seems to be working. Like mentioned in the original post: Through the root user I was able to edit the sudoers file and add my user – which is an Admin account and the only "real" account on the machine. It's the user that I have created in the onboarding process.

Using the NOPASSWD option in the sudoers file will allow me to run commands like sudo mkdir test with my normal user. Without using NOPASSWD it will prompt for my password but it won't accept my password.

ag@ag ~ % sudo mkdir test
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
sudo: 3 incorrect password attempts

The scripts that I'm running are mostly bash files but some require sudo to properly set system defaults like this for example:

sudo scutil --set ComputerName "$COMPUTER_NAME"
sudo scutil --set HostName "$COMPUTER_NAME"
sudo scutil --set LocalHostName "$COMPUTER_NAME"

Reply

Answer 5

CLTrec Author

Level 1

8 points

Jun 4, 2021 1:51 AM in response to Calvin_BT

I have done this already. When I now try to use sudo while being logged in as ag I well get promted to enter my password. This results in the following:

ag@ag ~ % sudo mkdir test
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
sudo: 3 incorrect password attempts

My password is correct. I even set it to a 4 digit number for testing purposes (make sure I'm just not too dumb to type) but it won't accept the password. No matter what.

Reply

Answer 6

CLTrec Author

Level 1

8 points

Jun 5, 2021 3:23 AM in response to HWTech

Oh, I remember reading about this a while back, but totally forgot about it again. I have been editing the sudoers file on my Linux machines quite a lot and never ran into any issues. Before the fresh install I also didn't have any issues on Mac.

Anyway: Your suggested solution did the trick! It seems to be working without any issues now. Maybe it's actually a good habit to get into in general.

Thank you very much for your help!

Reply

Answer 7

HWTech

Level 9

60,254 points

Jun 5, 2021 9:43 AM in response to CLTrec

I'm glad it worked, thanks for following up.

Putting your customizations into a separate folder & file also makes it much easier to backup those modifications. Keep that in mind for other modifications if you see a separate *.d folder with the same name as the main configuration file. Another such example on Linux is the GRUB configuration files which should have modifications added to the "/etc/grub.d" folder, but there are others as well (even on macOS).

Reply

Catalina Sudo Issues

Similar questions