The install script assumes the admin group already has sudo #1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
install-oath-sudo.shwrites two sudoers drop-ins:50-oath-enroll—%<group> ALL=(root) NOPASSWD: /usr/local/sbin/oath-enroll "", the bootstrap path51-oath-timestamp—Defaults timestamp_timeout=15Neither grants the admin group general sudo. On a host where that grant already exists (an existing admin box) nothing is wrong. On a fresh node it produces a confusing result: the OTP is accepted and authorisation then fails.
That is the correct order — authenticate, then authorise — and it reads like the OTP failed when it did not.
Measured 2026-09-24 while implementing this on a fresh NixOS node (homelab#97), where nothing had granted
echo_adminsudo beforehand.Worth deciding rather than leaving implicit: either the installer writes the general grant too (with a flag, since on an existing host it would be redundant), or the README states that the admin group must already have sudo and that this script only adds the OTP factor and the bootstrap path.
The second is probably right — the script's job is the sudo factor, not the sudo policy — but it should say so.