There is a very limited security advantage in having
requiretty on a server. If some non-root code is exploited (a PHP script, for example), the
requiretty option means that the exploit code won't be able to directly upgrade its privileges by running
There may be another way for the attacker to gain root, and of course the attacker will still be able to deface your site, but not letting the attacker gain root means that other services running as different users will keep running normally and the attacker won't be able to erase system logs. If none of your
sudo rules do anything dangerous like creating a directory, this isn't a concern.
Furthermore — and more damning for
requiretty — no privilege is needed to create a tty, e.g. with expect. So you might as well turn off
requiretty: on its own, it does not provide a security advantage. It does provide a mild auditability advantage when executed by users (because the logs give a better idea of who invoked
sudo and where they're coming from), but not when executed from a background job.