[baobun]

Tangent(?) on the SUSE PAM part: I was always tripped up by openSUSE default sudo behavior compared to other dists. Unless run with root, it will prompt you for the password of the target user, not your current one, even when current is allowed by sudoers policy.

So 'sudo -u foo bash' will prompt for the password of user foo, 'sudo bash' will prompt for the root password.

Haven't looked closer on how deep this custom configuration goes but would be nice to not have to carry around actual root password for sudo.

[Arnavion]

It is still the default but it's also trivial to change, so you don't have to "carry around actual root password" for any longer than it takes to create a dropin in /etc/sudoers.d/ with `Defaults !targetpw; %wheel ALL=(ALL) ALL`