Updated: 12 October 2026 · Applies to: sudo 1.9.16p2 (Debian 13), 1.9.15p5 (Ubuntu 24.04), 1.9.17p2 (AlmaLinux 10 and Rocky Linux 9) and sudo-rs 0.2.13 (Ubuntu 26.04), tested

sudo: 3 incorrect password attempts means sudo rejected the password three times in a row and gave up. By default sudo asks for your own login password, the password of the account you are logged in as, not the root password. Run the command again and type your own password carefully (nothing appears on the screen while you type). If you do not know it, set a new one as root with passwd yourname, as shown below.

This is what it looks like on Debian 13, Ubuntu 24.04, AlmaLinux 10 and Rocky Linux 9 (lab example from a test container):

$ sudo ls /root
[sudo] password for alice:
Sorry, try again.
[sudo] password for alice:
Sorry, try again.
[sudo] password for alice:
sudo: 3 incorrect password attempts

Ubuntu 26.04 uses sudo-rs by default, which words it differently:

$ sudo ls /root
[sudo: authenticate] Password: ******
sudo: Authentication failed, try again.
[sudo: authenticate] Password: ******
sudo: Authentication failed, try again.
[sudo: authenticate] Password: ******
sudo: maximum 3 incorrect authentication attempts

Why sudo rejects a password you think is right

  • You typed the root password. The prompt [sudo] password for alice asks for alice's password. Only when it says password for root does sudo want the root password (see rootpw below).
  • Caps Lock or keyboard layout. A browser console may use a different keyboard layout from yours.
  • The account is locked after failed attempts. On AlmaLinux, Rocky Linux and RHEL with pam_faillock enabled, sudo keeps saying Sorry, try again. even for the correct password until the lock expires. See the faillock section below.
  • The user has no password. Users created only with SSH keys have no password to type. Set one with passwd as root.
  • A different message means a different problem. alice is not in the sudoers file. (or on Ubuntu 26.04 sudo: I'm sorry alice. I'm afraid I can't do that) means the password was fine but the user has no sudo rights. Fix that with User Is Not in the sudoers File: Fix It on Debian and Ubuntu or, on the RHEL family, Add a User to wheel for sudo on AlmaLinux, Rocky Linux, RHEL.

How to set or change the sudo password

There is no separate sudo password. Setting the user's login password sets the password sudo asks for.

  1. Change your own password (you need the current one): 
    $ passwd
Changing password for alice.
Current password:
New password:
Retype new password:
passwd: password updated successfully
  2. Set another user's password as root, or with sudo from an admin account, without knowing the old one: 
    # passwd alice
New password:
Retype new password:
passwd: password updated successfully
  3. Set the root password the same way with sudo passwd root. You need it for su, for logging in as root at the console, and when sudo uses rootpw.
  4. If no account on the server can use sudo any more, log in as root through the server console. On a Ucartz VPS, open the console from Virtualizor (How to Access Your VPS via VNC in Virtualizor) and run passwd username; if you do not know the root password either, use How to Enable Rescue Mode for Your VPS Using Virtualizor.

More options, such as setting passwords from a script with chpasswd, are in How to Change a User Password in Linux (passwd and chpasswd). To stop sudo from asking at all, see How to Run sudo Without a Password (sudoers NOPASSWD); to make it ask less often, see How to Keep sudo Password Timeout Session Longer in Linux?

Unlock an account locked by faillock (AlmaLinux, Rocky Linux, RHEL)

When the with-faillock feature of authselect is on, three failed logins lock the account. The commented defaults in /etc/security/faillock.conf on AlmaLinux 10 are deny = 3 and unlock_time = 600 (10 minutes). Check and clear the lock as root:

# faillock --user alice
alice:
When                Type  Source                                           Valid
2026-10-11 17:52:09 TTY   /dev/pts/0                                           V
2026-10-11 17:52:12 TTY   /dev/pts/0                                           V
2026-10-11 17:52:14 TTY   /dev/pts/0                                           V
# faillock --user alice --reset

In our test, the correct password was refused until the reset and accepted right after it. authselect current shows whether with-faillock is enabled.

Change the number of password tries

The limit of three comes from the sudoers option passwd_tries. Set it in a drop-in file with visudo, which checks the syntax before saving:

sudo visudo -f /etc/sudoers.d/tries

Add this line, then save:

Defaults passwd_tries=5

After five wrong passwords, sudo now ends with sudo: 5 incorrect password attempts (sudo-rs on Ubuntu 26.04: sudo: maximum 5 incorrect authentication attempts). If you break the sudoers file, How to fix a broken sudoers file (sudo: parse error in sudoers) in Ubuntu? shows how to recover.

Change the error message, or let sudo insult you

Classic sudo can print your own text instead of Sorry, try again.:

Defaults badpass_message="Wrong password, try again."

Or, for some fun on a test server, it can insult the person who typed the wrong password:

Defaults insults
$ sudo ls /root
[sudo] password for alice:
Hold it up to the light --- not a brain in sight!
[sudo] password for alice:
Your mother was a hamster and your father smelt of elderberries!
[sudo] password for alice:
sudo: 3 incorrect password attempts

Insults worked on Debian 13, Ubuntu 24.04, AlmaLinux 10 and Rocky Linux 9; the text is random each time and appears instead of Sorry, try again.

sudo-rs on Ubuntu 26.04 supports neither: visudo accepted Defaults insults but sudo-rs printed no insults, and badpass_message made visudo report unknown setting: 'badpass_message' and visudo: invalid sudoers file. The classic sudo is still installed there as sudo.ws.

Other password settings worth knowing

  • Defaults rootpw: sudo asks for the root password instead of the user's. Classic sudo then shows [sudo] password for root:; sudo-rs keeps the same prompt, but in our test it accepted only the root password.
  • sudo -V run as root lists the current values, such as Number of tries to enter a password: 3. The time sudo remembers your password was 15 minutes on Debian 13 and Ubuntu 24.04 and 5 minutes on AlmaLinux 10 and Rocky Linux 9.
  • Password feedback (asterisks while typing) is on by default in sudo-rs; for classic sudo see How to Enable Password Feedback (Asterisks) for Sudo Command in Linux?

Where failed sudo attempts are logged

Classic sudo writes one line per failed run to /var/log/auth.log on Debian and Ubuntu and to /var/log/secure on AlmaLinux and Rocky Linux:

vps sudo:    alice : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/ls /root

Check it with sudo grep "incorrect password" /var/log/auth.log, or with journalctl -t sudo on servers that log only to the systemd journal (Useful journalctl Command Examples (Cheat Sheet)). sudo-rs does not write this line: in our test only the PAM line pam_unix(sudo:auth): authentication failure appeared. Many failures from an account you do not recognise can mean someone is guessing passwords.

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (1 Votes)