Sudo Plugin Issues

Problem

Symptoms and solution

Plugin denies every command

Symptoms:

  • All sudo commands are denied regardless of policy configuration.

  • No commands are authorized even when matching whitelist patterns.

Solution:

  • Check /etc/fudo/approval.key ownership and permissions:

    • Must be owned by root:root

    • Permissions must be 0600 (read/write for owner only)

    • Run: chown root:root /etc/fudo/approval.key && chmod 0600 /etc/fudo/approval.key

  • Verify that the Fudo CA certificate is trusted on the target system.

  • Check if the API user has all required privileges (see Typical Role Scenarios and Required Privileges).

Command unexpectedly denied

Symptoms:

  • Sudo command is denied despite having a valid Fudo session.

  • Command appears to match configured regular expressions.

Solution:

  • Check the audit trail via API: GET /api/v2/session/<id>/command

  • Review Fudo Enterprise event logs for entries:

    • FUI1157 - Command approved (includes matched policy and regex)

    • FUW1158 - Command denied (includes denial reason)

  • Verify the regular expression pattern matches the full binary path.

  • Ensure the policy is attached to the correct safe.

  • Check if the policy type is set to Whitelist.

No notifications for matched policy

Symptoms:

  • Sudo commands are being evaluated by policy.

  • No email, push, or SNMP notifications are received.

Solution:

  • Verify the policy has the corresponding notification flags enabled:

    • Email notification flag

    • Push notification flag (Fudo Officer)

    • SNMP trap flag

  • Check notification service configuration in Fudo Enterprise settings.

  • Verify SMTP server settings for email notifications.

  • Ensure Fudo Officer is properly configured for push notifications.

Local console sudo fails

Symptoms:

  • Sudo commands work through Fudo SSH sessions.

  • Local console sudo on the target server is always denied.

  • Direct SSH (not through Fudo) sudo commands fail.

Cause: This is the designed behavior, not a bug.

Explanation:

The plugin blocks ALL non-Fudo sudo commands because:

  • Local console sessions have no Fudo session mapping

  • Direct SSH connections bypass Fudo Enterprise authorization

  • Only commands executed within Fudo sessions can be evaluated against policies

This ensures all privileged commands are audited and controlled through Fudo Enterprise.

Plugin not loading

Symptoms:

  • sudo -V does not show fudo_approval in the plugin list.

  • Sudo commands are not being intercepted.

Solution:

  • Verify plugin installation:

    • Check if fudo_approval.so exists in the sudo plugin directory

    • Verify /etc/sudo.conf contains the plugin configuration

    • Ensure sudo version is 1.9 or newer (sudo -V)

  • Check system logs for plugin loading errors:

    • Review /var/log/syslog or journalctl for sudo-related errors

    • Look for permission or library dependency issues

  • Reinstall the plugin if necessary.

Related topics: