I have a problem with gksu command. It always ask for password only once even when I set Defaults passwd_tries=3 in /etc/sudoers file.Command:$ gksu -S --debug lsNo ask_pass set, using default!xauth: /tmp/libgksu-h36DCX/.XauthoritySTARTUP_ID: gksu/ls/5207-0-LIFEBOOK-A532_TIME5108327cmd[0]: /usr/bin/sudocmd[1]: -Hcmd[2]: -Scmd[3]: -pcmd[4]: GNOME_SUDO_PASScmd[5]: -ucmd[6]: rootcmd[7]: --cmd[8]: lsbuffer: -GNOME_SUDO_PASS-brute force GNOME_SUDO_PASS ended...Yeah, we're in...xauth: /tmp/libgksu-h36DCX/.Xauthorityxauth_env: /home/mzajac/.Xauthoritydir: /tmp/libgksu-h36DCXIt does not ask for correct password again. How can I fix it so it ask three times for correct password?My sudo configuration:# sudo -VSudo version 1.8.9p5Configure options: --prefix=/usr -v --with-all-insults --with-pam --with-fqdn --with-logging=syslog --with-logfac=authpriv --with-env-editor --with-editor=/usr/bin/editor --with-timeout=15 --with-password-timeout=0 --with-passprompt=[sudo] password for %p:  --without-lecture --with-tty-tickets --disable-root-mailer --enable-admin-flag --with-sendmail=/usr/sbin/sendmail --with-timedir=/var/lib/sudo --mandir=/usr/share/man --libexecdir=/usr/lib/sudo --with-sssd --with-sssd-lib=/usr/lib/x86_64-linux-gnu --with-selinuxSudoers policy plugin version 1.8.9p5Sudoers file grammar version 43Sudoers path: /etc/sudoersAuthentication methods: 'pam'Syslog facility if syslog is being used for logging: authprivSyslog priority to use when user authenticates successfully: noticeSyslog priority to use when user authenticates unsuccessfully: alertSend mail if user authentication failsSend mail if the user is not in sudoersUse a separate timestamp for each user/tty comboLecture user the first time they run sudoRequire users to authenticate by defaultRoot may run sudoAllow some information gathering to give useful error messagesRequire fully-qualified hostnames in the sudoers fileVisudo will honor the EDITOR environment variableSet the LOGNAME and USER environment variablesLength at which to wrap log file lines (0 for no wrap): 80Authentication timestamp timeout: 15.0 minutesPassword prompt timeout: 0.0 minutesNumber of tries to enter a password: 3Umask to use or 0777 to use user's: 022Path to mail program: /usr/sbin/sendmailFlags for mail program: -tAddress to send mail to: rootSubject line for mail messages: *** SECURITY information for %h ***Incorrect password message: Sorry, try again.Path to authentication timestamp dir: /var/lib/sudoDefault password prompt: [sudo] password for %p: Default user to run commands as: rootValue to override user's $PATH with: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binPath to the editor for use by visudo: /usr/bin/editorWhen to require a password for 'list' pseudocommand: anyWhen to require a password for 'verify' pseudocommand: allFile descriptors >= 3 will be closed before executing a commandReset the environment to a default set of variablesEnvironment variables to check for sanity:    TERM    LINGUAS    LC_*    LANGUAGE    LANG    COLORTERMEnvironment variables to remove:    RUBYOPT    RUBYLIB    PYTHONUSERBASE    PYTHONINSPECT    PYTHONPATH    PYTHONHOME    TMPPREFIX    ZDOTDIR    READNULLCMD    NULLCMD    FPATH    PERL5DB    PERL5OPT    PERL5LIB    PERLLIB    PERLIO_DEBUG     JAVA_TOOL_OPTIONS    SHELLOPTS    GLOBIGNORE    PS4    BASH_ENV    ENV    TERMCAP    TERMPATH    TERMINFO_DIRS    TERMINFO    _RLD*    LD_*    PATH_LOCALE    NLSPATH    HOSTALIASES    RES_OPTIONS    LOCALDOMAIN    CDPATH    IFSEnvironment variables to preserve:    XAUTHORIZATION    XAUTHORITY    TZ    PS2    PS1    PATH    LS_COLORS    KRB5CCNAME    HOSTNAME    HOME    DISPLAY    COLORSLocale to use while parsing sudoers: CDirectory in which to store input/output logs: /var/log/sudo-ioFile in which to store the input/output log: %{seq}Add an entry to the utmp/utmpx file when allocating a ptyPAM service name to usePAM service name to use for login shellsCreate a new PAM session for the command to run inMaximum I/O log sequence number: 0Local IP address and netmask pairs:    10.50.52.47/255.255.252.0    fe80::2ed4:44ff:fea2:2c4d/ffff:ffff:ffff:ffff::Sudoers I/O plugin version 1.8.9p5My /etc/sudoers file (I tried setting passwd_tries=3 but removed it because it didn't work):## This file MUST be edited with the 'visudo' command as root.## Please consider adding local content in /etc/sudoers.d/ instead of# directly modifying this file.## See the man page for details on how to write a sudoers file.#Defaults env_resetDefaults mail_badpassDefaults secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin# Host alias specification# User alias specification# Cmnd alias specification# User privilege specificationroot ALL=(ALL:ALL) ALL# Members of the admin group may gain root privileges%admin ALL=(ALL) ALL# Allow members of group sudo to execute any command%sudo ALL=(ALL:ALL) ALL# See sudoers(5) for more information on #include directives:#includedir /etc/sudoers.d /etc/pam.d/sudo :#%PAM-1.0 auth      required  pam_env.so readenv=1 user_readenv=0auth      required  pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0@include common-auth@include common-account@include common-session-noninteractive/etc/pam.d/common-account:## /etc/pam.d/common-account - authorization settings common to all services## This file is included from other service-specific PAM config files,# and should contain a list of the authorization modules that define# the central access policy for use on the system.  The default is to# only deny service to users whose accounts are expired in /etc/shadow.## As of pam 1.0.1-6, this file is managed by pam-auth-update by default.# To take advantage of this, it is recommended that you configure any# local modules either before or after the default block, and use# pam-auth-update to manage selection of other modules.  See# pam-auth-update(8) for details.# # here are the per-package modules (the Primary block)account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeedsaccount requisite pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundaccount required pam_permit.so# and here are more per-package modules (the Additional block)# end of pam-auth-update config/etc/pam.d/common-auth:## /etc/pam.d/common-auth - authentication settings common to all services## This file is included from other service-specific PAM config files,# and should contain a list of the authentication modules that define# the central authentication scheme for use on the system# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the# traditional Unix authentication mechanisms.## As of pam 1.0.1-6, this file is managed by pam-auth-update by default.# To take advantage of this, it is recommended that you configure any# local modules either before or after the default block, and use# pam-auth-update to manage selection of other modules.  See# pam-auth-update(8) for details. # here are the per-package modules (the Primary block)auth [success=1 default=ignore] pam_unix.so nullok_secure# here's the fallback if no module succeedsauth requisite pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundauth required pam_permit.so# and here are more per-package modules (the Additional block)auth optional pam_ecryptfs.so unwrapauth optional pam_cap.so # end of pam-auth-update config/etc/pam.d/common-session-noninteractive :## /etc/pam.d/common-session-noninteractive - session-related modules# common to all non-interactive services## This file is included from other service-specific PAM config files,# and should contain a list of modules that define tasks to be performed# at the start and end of all non-interactive sessions.## As of pam 1.0.1-6, this file is managed by pam-auth-update by default.# To take advantage of this, it is recommended that you configure any# local modules either before or after the default block, and use# pam-auth-update to manage selection of other modules.  See# pam-auth-update(8) for details. # here are the per-package modules (the Primary block)session [default=1] pam_permit.so# here's the fallback if no module succeedssession requisite pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundsession required pam_permit.so# The pam_umask module will set the umask according to the system default in# /etc/login.defs and user settings, solving the problem of different# umask settings with different shells, display managers, remote sessions etc.# See man pam_umask.session optional pam_umask.so# and here are more per-package modules (the Additional block)session required pam_unix.so session optional pam_ecryptfs.so unwrap# end of pam-auth-update config
gksu -S ask for password only once even when set to three times in sudo configuration
linux mint;sudo;password;pam;gksu