password prompt is different from ogsudo

[raviksharma]

Describe the bug
The console stdout based automation breaks because the password prompt is different from ogsudo.

Is there a reason for this? This is likely to break a lot of https://en.wikipedia.org/wiki/Expect based scripts.

To Reproduce

p@p:~/sudo-rs-8/rust-sudo-rs-gu$ sudo echo hello
[sudo] password for p: 
sudo: a password is required
p@p:~/sudo-rs-8/rust-sudo-rs-gu$ sudo-rs echo hello
[sudo: authenticate] Password: 

Expected behavior
password prompt should say

[sudo] password for <USERNAME>:

[squell]

Ogsudo uses a regular expression in an attempt to recognize password prompts and replace them with the '[sudo] password for' prompt. But this doesn't work well in cases where a different form of authentication is used (e.g. Yubikey-based authentication which doesn't say "Password:" but rather something like "PIN:"; and in that case it's also not very obvious to see that the prompt is coming from sudo).

So sudo-rs transparently prints whatever PAM tells us to print (which can by several things) and what category the PAM prompt is. In this case that is an authentication prompt with the content "Password:". This was by design.

[squell]

One question that I'm sure will interest us: how common would it be nowadays for scripts to pass passwords to sudo in this fashion? It feels to me that a scripted approach would benefit from handling the authentication at the SSH layer (cryptographic keys etc) and then have the user on the remote machine controlled by the script to have appropriate NOPASSWD: privileges in a sudoers configuration, rather then sending passwords.

Note that for tools that act as a UI around sudo we do support the --prompt "" option to let authentication prompts be silent. Related issues: #842, #162

[raviksharma]

Thanks for the explanation. I am closing this bug.