PAM and sudo issues

Troubleshooting guide for sudo with MFA and the Alpamon PAM module (alpamon-pam). Each section starts with the message you see, then explains the cause and the fix.

”A terminal is required to authenticate”

On sudo-rs hosts (Ubuntu 25.10 and later), a sudo command run without a terminal—for example through alpacon exec—can fail with:

sudo: A terminal is required to authenticate

This means the sudo attempt did not complete Alpacon authorization. Unlike classic sudo, sudo-rs cannot show the reason when no terminal is attached, so it prints this generic message instead. The most common causes are:

  • The command was denied—for example, no sudo policy on the work session matches it—and the reason is hidden because there is no terminal.
  • sudo with MFA is disabled for the workspace.
  • Alpamon is not running on the server.
  • The sudo command did not originate from a tracked Alpacon session.

Find the real cause: run journalctl -u alpamon on the server around the time of the attempt and look for these lines.

Log lineMeaning
No session found for PIDThe sudo did not come from a tracked Alpacon session. Run it inside an approved work session or an interactive Websh session.
sudo_approval response timeoutAlpacon sent the request but received no answer from the server in time. Check connectivity and retry.
Processing sudo_approval response with approved=false and an error_codeThe command was explicitly denied. Look up the code in “Alpacon denied this sudo command”.

The user has no sudoers rule

Depending on the sudo implementation, a user with no permission to run sudo sees one of:

# sudo-rs (Ubuntu 25.10+)
sudo: I'm sorry user. I'm afraid I can't do that

# classic sudo
user is not in the sudoers file.

On Alpacon-managed hosts, the sudoers rule that grants sudo through Alpacon (%alpacon) is installed together with the PAM module (alpamon-pam). Seeing this message usually means alpamon-pam is not installed on the server. Check whether the package is present:

# Debian/Ubuntu
dpkg-query -W alpamon-pam
 
# RHEL/CentOS/Rocky/Alma/Fedora
rpm -q alpamon-pam

To reinstall it:

  • A single server: install the package with the system package manager—apt-get install -y alpamon-pam on Debian/Ubuntu, yum install -y alpamon-pam on RHEL-based systems. See installation.
  • The whole workspace: if Use sudo with MFA is turned off, turning it back on in Server access policies reinstalls alpamon-pam on all currently connected servers.

”Alpacon denied this sudo command”

When Alpacon blocks a sudo command, it returns a message with an error code:

Alpacon denied this sudo command (SUDO_NO_WORKSESSION_POLICY)

The code tells you why it was denied and what to do.

CodeMeaningWhat to do
SUDO_SESSION_MISSINGThe command was not started under an approved session.Run sudo inside an approved work session or an interactive Websh session.
SUDO_NO_WORKSESSION_POLICYThe work session has no sudo policy that matches this command.Add a matching pattern with work-session update --sudo, and check the pattern rules—the sudo prefix is not part of the matched command, the whole command must match, and * is the only wildcard.
WORKSPACE_SUDO_WITH_MFA_DISABLEDUse sudo with MFA is turned off for the workspace.Ask a Superuser to enable it in Server access policies.

Verifying the installed PAM module

The server detail page shows a PAM version for each server. This is the last version the agent reported—it does not update when the package is removed or changed out-of-band (for example, uninstalled directly on the host). When in doubt, verify on the server itself:

# Debian/Ubuntu
dpkg-query -W alpamon-pam
 
# RHEL/CentOS/Rocky/Alma/Fedora
rpm -q alpamon-pam
Last updated: