Sudo authentication for expired local passwords on Linux Mint

Resolution

To allow a user with an expired password to authenticate via sudo while blocking graphical login and avoiding sudo group membership, you must decouple the authentication (verifying the password) from the account validation (checking if the password has expired).

By default, the sudo PAM stack evaluates account expiration. If the password is expired, pam_unix returns a failure during the account phase, and sudo denies access. To bypass this for specific users, you must modify the PAM configuration to ignore account expiration for the sudo service.

Implementation Steps

1. Grant Specific Sudo Privileges: Do not add the user to the sudo group. Instead, add a specific entry to the sudoers file using visudo:

   username ALL=(ALL) ALL

2. Modify the Sudo PAM Stack: Edit /etc/pam.d/sudo. Locate the account section. To allow expired passwords to still authenticate, you can change the required flag for pam_unix.so to sufficient or add nullok, though the most direct method to ignore expiration is to comment out the account check for pam_unix specifically within the sudo service stack:

   # account required pam_unix.so

   Note: This allows any user with a valid password—even if expired—to use sudo, provided they are listed in the sudoers file.
3. Force Password Change at Login: Ensure /etc/pam.d/lightdm (or your specific display manager) retains account required pam_unix.so. This ensures that while sudo ignores the expiration, the graphical login environment still detects it and blocks access or prompts for a reset.

Technical Explanation

This behavior is governed by the Pluggable Authentication Modules (PAM) architecture. PAM splits the login process into distinct phases: auth (Who are you?), account (Are you allowed in right now?), password (Change your password), and session (Set up the environment).

When a password expires according to /etc/shadow, pam_unix.so fails during the account phase. Because sudo is a command-line utility, it cannot easily handle the interactive password-change flow triggered by PAM_NEW_AUTHTOK_REQD, leading to a hard authentication failure. By removing the account check from /etc/pam.d/sudo, you tell the system: "If the password is correct (auth phase), I don't care if the account is expired (account phase)."

Verification

To verify the current expiration status of the user, run:

sudo chage -l username

Diagnostic Requirement

Please specify the Linux Mint version (e.g., 21.3) and the base Ubuntu version. PAM module behavior and default file structures in /etc/pam.d/ can vary between releases, which may necessitate adjusting the specific line numbers or module flags used in the sudo stack.