Solved Something asking for a password when I run su in doas/sudo root subshell

[bileslav]

If I, as my user vlad, run doas -s, or doas -S, or sudo -s, and type my password, I became root. If then I run su vlad, I get this:

# su vlad
vlad@M.FCKDOM.ORG's Password:

Regardless of what I type as the password, I get this:

su: krb5_verify_user: unable to reach any KDC in realm M.FCKDOM.ORG
$

So, it's suing anyway, but what a heck?

If I, instead, run just su, or su -, or sudo -i, and then su vlad, it will not ask me for a password, as I would always expect.

I have default {,/usr/local}/etc/pam.d configuration, where all lines related to krb5 are commented.

Also, my hostname is hq.m.fckdom.org, not M.FCKDOM.ORG.

 

[Kai Burghardt]

[…] If I, instead, run just su, or su -, or sudo -i, and then su vlad, it will not ask me for a password, as I would always expect. […]

I guess you have security/heimdal installed so its /usr/local/bin/su appears earlier in the regular user’s $PATH thus taking precedence.​

type su; printenv PATH # run both as `vlad` and (in a login session [`sudo -i`] of) `root`

 

[bileslav]

Kai Burghardt, you're right on point:

$ su -
Password:
# printenv PATH
/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin
# command -v su
/usr/bin/su

$ doas -S
Password:
# printenv PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# command -v su
/usr/local/bin/su

$ sudo -i
Password:
# printenv PATH
/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin
# command -v su
/usr/bin/su

Interesting. The difference between the default settings of doas -S and sudo -i is also noteworthy (both are full login). I don't even know whether there's anything here that can be considered a bug. At least, now I'm aware of this pitfall and how to fix it. Thank you.

 

[bileslav]

Also, I use fish as my shell, which I guess also contributes.