Hello everyone, I’m looking for any help to explain some unexpected sudo behaviour.
While logged in as my own user (not root) via ssh, I used sudo to start a scrub, and unexpectedly received the “lecture” message that you normally only get when using sudo for the first time (“We trust you have received the usual lecture from the local System Administrator…”).
I know I’ve used sudo before, for example to trigger previous scrubs. Looking at the shell history, plus the “Last login” date and the output of “zpool history”, I’m pretty sure I used sudo to start a scrub as recently as 17 March, and I don’t remember receiving the message then.
The only out-of-the-ordinary event I can think of since then is that the machine was powered off for a couple of weeks, but I wouldn’t have expected a restart to reset this message.
Does anyone know what might have caused this behaviour, and is it anything to worry about (either from a security or other perspective)? I’m always a bit wary when something unexpected happens!
In case it’s relevant:
- /usr/local/etc/sudoers is now timestamped from when I most recently restarted the machine (7 April)
- /var/db/sudo/lectured/ and my username file inside are now timestamped from when I just used sudo and received the message (yesterday — I assume the fact that the message appeared means that they were not present immediately beforehand, and were created)
- I’m running TrueNAS CORE 13.0-U5.3.