sudo command does not work in remote session to Linux machine

Steps to reproduce

Build and setup SSH based remoting (see docs) on a Linux machine
Start an interactive remote session to the same machine
Enter-PSSession -HostName -UserName
[] C:> sudo ls /proc/powershell

Expected behavior

sudo command to run in remote interactive session.

Actual behavior

sudo : sudo: no tty present and no askpass program specified
    + CategoryInfo          : NotSpecified: (sudo: no tty pr...ogram specified:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

Environment data

Name Value

PSVersion 5.1.10032.0
PSEdition PowerShellCore
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 3.0.0.0
GitCommitId v0.6.0-392-ga5b5dc576b8006c0d0a83a5c538f382d9fa65dc6
CLRVersion
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

For people on 7.0 they could just do 'my password' | sudo -s something in PowerShell to cache your sudo credential so subsequent calls don't prompt you for it. Not ideal but it's what we have to work with.

Which would honestly be fine, if the following worked (which it doesn't).

$creds = Get-Credential
$session = New-PSSession -hostname Workstation1 -Username foo -SSHTransport
Invoke-Command -Session $session {param($creds) Invoke-Expression "echo $creds.password | sudo -S whoami"} -Argumentlist $creds

In 7.0, I cannot find a single way to pass secure strings to a PSSession, so scripting a sudo command is not possible. That sound about right?

Outside of a PSSession, it is possible to run something like ssh -t foo@Workstation1 'sudo whoami' and be prompted for 2 passwords, but it would be nice to do this within the confines of PSSession in 7.0.

Which would honestly be fine, if the following worked (which it doesn't).

That's because you are trying to send a secure string across which doesn't work on non-Windows hosts until 7.1. If the password was plaintext like so then it would work

$creds = Get-Credential
$sudoPass = $creds.GetNetworkCredential().Password
$session = New-PSSession -hostname Workstation1 -Username foo -SSHTransport

Invoke-Command -Session $session {
    param(
        [String]
        $SudoPass
    )

    $null = $SudoPass | sudo -S whoami
    if ($LastExitCode -ne 0) {
        Write-Error -Message "Failed to cache sudo password"
        return
    }

    # Now you have cached your sudo password you should be able to call it normally (up to whatever
    # timeout you have configured)
    sudo whoami
} -Argumentlist $sudoPass

Note this is not tested and it may require some better logic to check for failures but it should work. I will agree it's also not good to send passwords as plaintext across the wire but at least SSH encrypts the traffic. There's nothing that can be done about this unless you are on 7.1+ as we've mentioned. Even then on 7.1+ the SecureString will not be encrypted in memory on the remote process due to how SecureStrings work on non-Windows hosts. The 2 benefits 7.1 provides are:

SecureStrings are encrypted with a unique session key when traversing the wire. If someone was able to decrypt or monitor the plaintext SSH packets then the password will still be encrypted
You can use the PSHost SecureString prompts as we've mentioned before

It's up to the PowerShell team to backport the changes in #11185. I have no idea what the general policy is for this for this project so I can't really comment on it more.

Also your example had Invoke-Expression, that is not needed at all. You typically don't need to use iex to call a native binary as all iex does is runs the specified string as a PowerShell command which you already have.

Jordan Borean (@jborean93)

Jordan Borean (@jborean93) in your example here you do:

# Parent is sudo, grandparent is the pwsh process
$parentPid = (Get-Process -Id {0}).Parent.Parent.Id

Where that {0} will be formatted as $pid of the process that called this cmdlet.

Do you still need to do the .Parent.Parent.Id?

Good catch, that should just be $parentPid = {0} or $parentPid = $env:SOMETHING. Was a leftover when I was just getting the grandparent PID which wouldn't work in all situations.

Jordan Borean (@jborean93)

Jordan Borean (@jborean93) do you have interest in contributing that cmdlet to the RemotingTools module so we can start getting validation? Your own separate module would also be totally cool.

I would be interested but I don't have any spare time in the current week. I would probably only be able to work on it properly in about 2 weeks or so. People are more than welcome to take what I have and work on it if I'm taking too long :).

Haven't seen any movement on this but see it as still open. I just started trying to manage *nix systems with remote PS sessions and this is a definite blocker.

Paul Higinbotham (@PaulHigin)

Paul Higinbotham (@PaulHigin) despite the lack of updates to this issue, I just tested again on pwsh 7.3.9 running on Debian 11 & 12. Still doesn't work when an interactive password is required but it does work with passwordless sudo, and you can workaround by piping a securestring into the sudo command (I don't remember if this was possible before).

example

[admin@test-deb11]: PS /home/admin> $pw = Read-Host -AsSecureString
WARNING: A script or application on the remote computer TEST-DEB11 is asking to read a line securely. Enter sensitive information, such as your credentials, only if you trust the remote computer and the application or script that is requesting it.
*******
[admin@test-deb11]: PS /home/admin> $pw | ConvertFrom-SecureString -AsPlainText | sudo -S cat /proc/cpuinfo

Sudo version is 1.9.5p2

This issue has been marked as "No Activity" as there has been no activity for 6 months. It has been closed for housekeeping purposes.

Steve Lee (@SteveL-MSFT)

Why is closed? is it actually done or not?

Steve Lee (@SteveL-MSFT) Jordan Borean (@jborean93)

Navigation Menu

Repository navigation

sudo command does not work in remote session to Linux machine #1527

Steps to reproduce

Expected behavior

Actual behavior

Environment data

41 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

sudo command does not work in remote session to Linux machine #1527

Description

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Activity

41 remaining items

thukk commented on Dec 2, 2020

jborean93 commented on Dec 2, 2020

TylerLeonhardt commented on Dec 2, 2020

jborean93 commented on Dec 2, 2020

TylerLeonhardt commented on Dec 2, 2020

jborean93 commented on Dec 2, 2020

IanEMartin commented on Jul 9, 2021

mcx808 commented on Nov 16, 2023

microsoft-github-policy-service commented on Nov 24, 2023

soroshsabz commented on Jun 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions