canonical / canonical/authd

Issue: sshuttle asking for sudo password fails

Open
#901 2 comments 0 reactions 1 assignee Claimed by @3v1n0 View on GitHub
Dominant language
Go
Stars
308
Forks
41
Avg merge
2d 4h
Merged PRs (30d)
58

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues and found none that matched mine

### Describe the issue

This is an issue I raised at [canonical/canonical-laptops#106](https://github.com/canonical/canonical-laptops/issues/106) (Canonical internal repo) - using sshuttle with the authd based setup there crashes on asking for credentials:

```
$ sshuttle -r localhost 10.0.0.0
authenticate: Waiting for PID 34070 failed with error No child processes
sudo: PAM authentication error: Unknown error -1
sudo: a password is required
fw: fatal: You must be root (or enable su/sudo) to set the firewall
c : fatal: All attempts to elevate privileges failed.
```

Note that sometimes the sudo password prompt does work. In this case it looks like this:

```
$ sshuttle -r localhost 10.0.0.0
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(redacteduser@localhost) Enter your local password:
>
```

I have a workaround where it works if I use sudo for something, then run sshuttle afterwards so that sudo won't ask for the password (because same shell session):

```
$ sudo ls
Enter your local password:
> ******
...

$ sshuttle ...
c : Connected to server.
```

But this isn't ideal long term.

I suspect it's something related to the new flow of how asking for the password can display an interactive menu in the terminal to choose between local or google password.

### Steps to reproduce

1. run `sshuttle -r localhost 10.0.0.0`

Expected: a sudo prompt in the console.

Actual: see error details above.

### System information and logs

#### authd version
```
authd 0.4.1
```

#### authd-msentraid broker version [not installed]
```
name: authd-msentraid
summary: Authd - MS Entra ID Cloud Authentication for Ubuntu
publisher: Canonical**
store-url: https://snapcraft.io/authd-msentraid
license: GPL-3.0-only
description: |
Authd is a powerful authentication service for Ubuntu, designed to
integrate with cloud identity providers like Microsoft Entra ID. It
delivers a secure, flexible solution for organizations and individuals who
are transitioning to cloud-based identity management on Ubuntu workstations
and servers.
Authd uses the OAuth Device Authorization Grant and ensures a consistent
and secure login experience across Ubuntu Desktop and Server — whether
through GDM, SSH, or network services like NFS and Samba.

Key Features
* Cloud identity provider Integration: Connects with Microsoft Entra ID
* Secure Login: Authd leverages the OAuth Device Authorization Grant RFC
8628-compliant workflows for reliability and security.
* Open-Source: Free and community-driven, with contributions welcomed.
* Enterprise ready: Ubuntu Pro customers will benefit from the same
expanded security and support guarantees.
* Authd is free for all Ubuntu Desktop and Server 24.04 LTS users and is
under active development. Explore the official documentation for
installation and configuration steps, or visit the GitHub repository to
contribute or provide feedback.
snap-id: vS3oJLMss6lgWwoFcPqYDUA2HB20I1Dc
channels:
0.x/stable: 0.2.0+33feab0.0d0d6c7 2025-02-03 (137) 19MB -
0.x/candidate: ^
0.x/beta: ^
0.x/edge: 0.2.0+a04b1ff.84a39dc 2025-04-21 (191) 20MB -
```

#### gnome-shell version
```
gnome-shell:
Installed: 46.3.1-1ubuntu1~24.04.1authd2
Candidate: 46.3.1-1ubuntu1~24.04.1authd2
Version table:
*** 46.3.1-1ubuntu1~24.04.1authd2 500
500 https://ppa.launchpadcontent.net/ubuntu-enterprise-desktop/authd/ubuntu noble/main amd64 Packages
100 /var/lib/dpkg/status
46.0-0ubuntu6~24.04.8 500
500 http://au.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
46.0-0ubuntu6~24.04.3 500
500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
46.0-0ubuntu5 500
500 http://au.archive.ubuntu.com/ubuntu noble/main amd64 Packages
```

#### Distribution
```
Distributor ID: Ubuntu
Description: Ubuntu 24.04.2 LTS
Release: 24.04
Codename: noble
```

#### Logs
```

```

#### authd broker configuration
#### /etc/authd/brokers.d/broker.conf
```
[oidc]
issuer = https://accounts.google.com
client_id = REDACTED
client_secret = REDACTED

[users]
ssh_allowed_suffixes = @canonical.com
```
#### /etc/authd/brokers.d/google.conf
```
# This section is used by authd to identify and communicate with the broker.
# It should not be edited.
[authd]
name = Google
brand_icon = /snap/authd-google/current/broker_icon.png
dbus_name = com.ubuntu.authd.Google
dbus_object = /com/ubuntu/authd/Google
```

#### authd-msentraid configuration
```
cat: /var/snap/authd-msentraid/current/broker.conf: No such file or directory
```

#### authd-google configuration
```
[oidc]
issuer = https://accounts.google.com
client_id =
client_secret =

[users]
ssh_allowed_suffixes = @canonical.com
```

### Double check your logs

- [x] I have redacted any sensitive information from the logs

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.