In non-interactive, sudo fail to with 'sudo: a password is required'

[gzm55]

The pam plugin should be correctly setup:

$ sudo -k id
uid=0(root) gid=0(root) groups=0(root)

the secure log

pam_ssh_agent(sudo:auth): Authenticating using ssh-agent at '/tmp/ssh-1EYwKbGPJs/agent.88681', keys from '/etc/security/authorized_keys.d/user'
pam_unix(sudo:session): session opened for user root by user(uid=0)
pam_unix(sudo:session): session closed for user root

But when run in non-interactive mode, we have errors

$ sudo -kn id
sudo: a password is required

And the secure log has not output.

I expect sudo -kn id should also run the id command.

[gzm55]

https://jpmens.net/2021/11/21/pam-ssh-agent-authentication-with-ansible/

from this blog, it seems that the previous pam_ssh_agent_auth also has this behavior.

[AdmiralNemo]

Yes, sudo -n only works for NOPASSWD rules in sudoers(5). To work around this, I had to set

ansible_become_password: unused

in the inventory variables for any hosts that use either implementation of PAM SSH agent authentication.

[gzm55]

thanks, can we mention this in document?

[nresare]

To me this seems like a sudo, or possibly ansible issue. I'm not categorically against adding a paragraph in the README if this is something that people oftentimes hit, but it needs to be clearly explained