[GH-ISSUE #876 ] Error 205: The user does not have permission to use sudo, but user in the sudo group. #237

Author

Owner

@pokamest commented on GitHub (Jul 9, 2024):

Does user amnezia asks for password when you use sudo ?

@pokamest commented on GitHub (Jul 9, 2024): Does user `amnezia` asks for password when you use sudo ?

bsakaguchi commented

Author

Owner

@dudarenko-io commented on GitHub (Jul 10, 2024):

Hi, I'm trying to use amnezia for very first time. Have the same issue. On my server I'm able to use sudo under amnezia user without password prompt
User settings looks like this:

amnezia         ALL=(ALL)       NOPASSWD: ALL
%wheel  ALL=(ALL)       NOPASSWD: ALL

uid=1001(amnezia) gid=1001(amnezia) groups=1001(amnezia),10(wheel)

@dudarenko-io commented on GitHub (Jul 10, 2024): Hi, I'm trying to use amnezia for very first time. Have the same issue. On my server I'm able to use sudo under amnezia user without password prompt User settings looks like this: ``` amnezia ALL=(ALL) NOPASSWD: ALL %wheel ALL=(ALL) NOPASSWD: ALL ``` ``` uid=1001(amnezia) gid=1001(amnezia) groups=1001(amnezia),10(wheel) ```

bsakaguchi commented

Author

Owner

@dudarenko-io commented on GitHub (Jul 10, 2024):

As far as i can see, this code expects the user to be in 'sudo' group. But there are several RHEL based distros in which sudo privileges are granted via 'wheel' group.
My server is an ec2 instance with amazon linux

@dudarenko-io commented on GitHub (Jul 10, 2024): As far as i can see, [this code](https://github.com/amnezia-vpn/amnezia-client/blob/3f90ee915d0effff8dc7a076364631299998498c/client/core/controllers/serverController.cpp#L767) expects the user to be in 'sudo' group. But there are several RHEL based distros in which sudo privileges are granted via 'wheel' group. My server is an ec2 instance with amazon linux

bsakaguchi commented

2026-10-13 20:16:24 +00:00

Author

Owner

@dudarenko-io commented on GitHub (Jul 10, 2024):

I changed distro to Ubuntu and now i have amnezia client passing this sudo check

@dudarenko-io commented on GitHub (Jul 10, 2024): I changed distro to Ubuntu and now i have amnezia client passing this sudo check

bsakaguchi commented

Author

Owner

@pokamest commented on GitHub (Jul 11, 2024):

Thank you for the information, it will be helpful for users.
@mekbectv Did you solve the issue?

@pokamest commented on GitHub (Jul 11, 2024): Thank you for the information, it will be helpful for users. @mekbectv Did you solve the issue?

bsakaguchi commented

2026-10-13 20:16:24 +00:00

Author

Owner

@moclauq commented on GitHub (Jul 11, 2024):

Does user amnezia asks for password when you use sudo ?

Yes

@moclauq commented on GitHub (Jul 11, 2024): > Does user `amnezia` asks for password when you use sudo ? Yes

bsakaguchi commented

Author

Owner

@moclauq commented on GitHub (Jul 11, 2024):

Thank you for the information, it will be helpful for users. @mekbectv Did you solve the issue?

No, the only option is to allow root login.

@moclauq commented on GitHub (Jul 11, 2024): > Thank you for the information, it will be helpful for users. @mekbectv Did you solve the issue? No, the only option is to allow root login.

bsakaguchi commented

Author

Owner

@karmicdude commented on GitHub (Jul 27, 2024):

The same issue.
amnezia user is added to the sudoers config with NOPASSWD. This of course works, I checked from the user himself - any commands are executed with sudo with no issues.
But when I try to install server I get the same error

The user does not have permission to use sudo

sftp subsystem also enabled.

AWS AMI ami-07d20571c32ba6cdc - Ubuntu 22.04 LTS from community (ubuntu-jammy-22.04-amd64-server-20240701)

@karmicdude commented on GitHub (Jul 27, 2024): The same issue. `amnezia` user is added to the `sudoers` config with `NOPASSWD`. This of course works, I checked from the user himself - any commands are executed with sudo with no issues. But when I try to install server I get the same error ``` The user does not have permission to use sudo ``` sftp subsystem also enabled. AWS AMI `ami-07d20571c32ba6cdc` - Ubuntu 22.04 LTS from community (ubuntu-jammy-22.04-amd64-server-20240701)

bsakaguchi commented

Author

Owner

@karmicdude commented on GitHub (Jul 27, 2024):

OK, I think I've figured out how to fix it, but I haven't yet understood the cause of this behaviour. I'll find out later.

In general, if you add the configuration for the amnezia user to the directory that is included in the main config (@includedir /etc/sudoers.d), everything works.

I.e. I moved the line from /etc/sudoers

amnezia ALL=(ALL) NOPASSWD:ALL

to /etc/sudoers.d/90-amnezia-user

And everything magically worked.

I checked a couple of times putting the line back in. It stops working. Something that I don't understand, I wonder. Anyway, I'll have a look later to find out the cause. But it can be "fixed" the way I described above.

@karmicdude commented on GitHub (Jul 27, 2024): OK, I think I've figured out how to fix it, but I haven't yet understood the cause of this behaviour. I'll find out later. In general, if you add the configuration for the `amnezia` user to the directory that is included in the main config (`@includedir /etc/sudoers.d`), everything works. I.e. I moved the line from `/etc/sudoers` ``` amnezia ALL=(ALL) NOPASSWD:ALL ``` to `/etc/sudoers.d/90-amnezia-user` And everything magically worked. I checked a couple of times putting the line back in. It stops working. Something that I don't understand, I wonder. Anyway, I'll have a look later to find out the cause. But it can be "fixed" the way I described above.

bsakaguchi commented

2026-10-13 20:16:26 +00:00

Author

Owner

@djvnsk commented on GitHub (Jul 30, 2024):

I tested this on ubuntu and it works strangely, you need to run the command:
usermod -aG sudo username
(or add username to the /etc/group file, for example: sudo❌27:username)

AND add this line to the /etc/sudoers.d/100-amnezia-user
username ALL=(ALL:ALL) NOPASSWD:ALL

In normal life for a normal user you only need to do one of these actions.
If you don't do the first action you will get error 205, if you don't do the second action (or don't specify NOPASSWD) you will get error 300.

@djvnsk commented on GitHub (Jul 30, 2024): I tested this on ubuntu and it works strangely, you need to run the command: usermod -aG sudo username (or add username to the /etc/group file, for example: sudo:x:27:username) AND add this line to the /etc/sudoers.d/100-amnezia-user username ALL=(ALL:ALL) NOPASSWD:ALL In normal life for a normal user you only need to do one of these actions. If you don't do the first action you will get error 205, if you don't do the second action (or don't specify NOPASSWD) you will get error 300.

bsakaguchi commented

Author

Owner

@karmicdude commented on GitHub (Jul 31, 2024):

I think this is a vendor related issue, i.e. AWS AMI. For example if you create an instance from AMI with no modification (default user ubuntu) this works fine. But if you delete the default user, create a new one with NOPASSWD access for any sudo commands, this doesn't work.
I still didn't research why it works this way, from cli all commands with sudo need no password, but amnezia script failed. I think this issue may be in pam configuration. User ubuntu needs to be working from AWS EC2 terminal, it leads that the community image has some modification.

@karmicdude commented on GitHub (Jul 31, 2024): I think this is a vendor related issue, i.e. AWS AMI. For example if you create an instance from AMI with no modification (default user `ubuntu`) this works fine. But if you delete the default user, create a new one with `NOPASSWD` access for any sudo commands, this doesn't work. I still didn't research why it works this way, from cli all commands with sudo need no password, but amnezia script failed. I think this issue may be in pam configuration. User `ubuntu` needs to be working from AWS EC2 terminal, it leads that the community image has some modification.

bsakaguchi commented

2026-10-13 20:16:26 +00:00

Author

Owner

@koxx009 commented on GitHub (Aug 16, 2024):

This is a bug (I think).
I think amnezia is adapted for Ubuntu/Debian based systems.
When using a RHEL-based systems, the sudo check fails because the script checks that the user is added to the sudo group, but in RHEL the sudo group is wheel and a group named sudo does not exist by design.

github.com/amnezia-vpn/amnezia-client@8fefae0325/client/core/controllers/serverController.cpp (L768)

But I found a workaround. Just create a simple group named sudo and add the user (amnezia) to that group (but the wheel group should also be added for real sudo grants), then the check will succeed

@koxx009 commented on GitHub (Aug 16, 2024): This is a bug (I think). I think amnezia is adapted for Ubuntu/Debian based systems. When using a RHEL-based systems, the sudo check fails because the script checks that the user is added to the `sudo` group, but in RHEL the sudo group is `wheel` and a group named `sudo` does not exist by design. https://github.com/amnezia-vpn/amnezia-client/blob/8fefae032598206982e5a25707877fafdd60e78b/client/core/controllers/serverController.cpp#L768 But I found a workaround. Just create a simple group named `sudo` and add the user (`amnezia`) to that group (but the `wheel` group should also be added for real sudo grants), then the check will succeed

bsakaguchi commented

2026-10-13 20:16:26 +00:00

Author

Owner

@Noksa commented on GitHub (Sep 6, 2024):

@koxx009 exactly. Thanks for the explanation. Tested on Amazon Linux 2 and it worked

[ec2-user@ip-10-3-3-74 ~]$ sudo groupadd sudo
[ec2-user@ip-10-3-3-74 ~]$ sudo usermod -aG sudo ec2-user

Now can continue in the app

@Noksa commented on GitHub (Sep 6, 2024): @koxx009 exactly. Thanks for the explanation. Tested on Amazon Linux 2 and it worked ```shell [ec2-user@ip-10-3-3-74 ~]$ sudo groupadd sudo [ec2-user@ip-10-3-3-74 ~]$ sudo usermod -aG sudo ec2-user ``` Now can continue in the app

bsakaguchi commented

Author

Owner

@AlexisHW commented on GitHub (Dec 16, 2024):

Same issue with CentOS 7
Create the fake 'sudo' group and added my user into it (already was in 'wheel'), 205 error gone

Then, I faced 300 error.
This is due to the client can't sudo with password. Had to add my user to sudoers without password:

# visudo
...
amnezia        ALL=(ALL)       NOPASSWD: ALL

@AlexisHW commented on GitHub (Dec 16, 2024): Same issue with CentOS 7 Create the fake '`sudo`' group and added my user into it (already was in '`wheel`'), 205 error gone Then, I faced 300 error. This is due to the client can't sudo with password. Had to add my user to sudoers without password: ``` # visudo ... amnezia ALL=(ALL) NOPASSWD: ALL ```

bsakaguchi commented

Author

Owner

@Erinaceto commented on GitHub (Jan 8, 2025):

Thank you! Fake sudo group helped on Rosa linux too.

@Erinaceto commented on GitHub (Jan 8, 2025): Thank you! Fake sudo group helped on Rosa linux too.

bsakaguchi commented

Author

Owner

@moclauq commented on GitHub (Mar 1, 2025):

I don't know why this happened. But in any case, I have already reinstalled the system and everything works. For RHEL users: Create a Sudo group.

@moclauq commented on GitHub (Mar 1, 2025): I don't know why this happened. But in any case, I have already reinstalled the system and everything works. For RHEL users: Create a Sudo group.

bsakaguchi commented