Debian 9 – sudo fails in automation with no tty present

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

CI, cron, or remote automation fails privilege escalation and leaves jobs incomplete.

Environment & Reproduction

Occurs in non-interactive sessions where sudo prompts cannot be satisfied.

# Capture baseline
sudo -l -U 
grep -R requiretty /etc/sudoers /etc/sudoers.d 2>/dev/null
id 

Root Cause Analysis

sudo policy requires tty or password interaction unavailable in headless execution contexts.

Quick Triage

Validate command path matching and effective sudoers scope for automation identity.

# Quick triage
sudo -n true; echo $?
which 
sudo -l -U 

Step-by-Step Diagnosis

Test exact automation command with non-interactive sudo and review auth logs.

# Detailed diagnosis
sudo -n 
journalctl -t sudo -n 120 --no-pager || true

Solution – Primary Fix

Grant tightly scoped NOPASSWD permissions for required automation commands only.

# Primary fix
echo ' ALL=NOPASSWD: /usr/bin/systemctl restart ' | sudo tee /etc/sudoers.d/-automation
sudo visudo -cf /etc/sudoers.d/-automation

Solution – Alternative Approaches

Wrap privileged steps in root-owned systemd units with controlled interfaces.

# Alternatives
sudo systemctl enable --now .service
sudo systemctl status .service --no-pager

Verification & Acceptance Criteria

Automation user executes only approved commands non-interactively and nothing broader.

# Verify
sudo -n 
sudo -l -U 

Rollback Plan

Remove sudoers drop-in if scope is too broad or behavior is unintended.

# Rollback
sudo rm -f /etc/sudoers.d/-automation
sudo visudo -c

Prevention & Hardening

Review sudoers changes through change control and policy lint checks.

# Hardening
sudo visudo -c
find /etc/sudoers.d -type f -maxdepth 1 -print

Related Errors & Cross-Refs

Related messages include no tty present and a terminal is required.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

sudoers manual and non-interactive automation security best practices.