Managing sudo via AD seems to have disabled NOPASSWD: for local user on one server, but not the other.

[ajkelsey]

I have two servers: A and B. The local user authenticates using an ssh-key on both servers. On server A, they can logon and use sudo without entering a password. On server B, they are prompted to enter a password when trying to use sudo. I have checked to ensure the sudoers file is correctly configured, and it is. I don't see any differences in sssd.conf. If anyone could point me into a direction that I could explore to solve this issue, I would appreciate it.

[millert]

You should compare the output of sudo -l on both systems. One thing to be aware of is that the order of the LDAP sudoers objects are not guaranteed to be the same on different systems. It's possible that what you are seeing is due to the sudoers rules being evaluated in different order on the two systems. The sudoOrder attribute can be used to help with this.

[ajkelsey]

Thanks, Todd. I'll see what I can find tomorrow. The issue did "resolve" itself when I enabled !authenticate in AD, though, it would be nice to know the underlying cause.