Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I run a command which requires root privileges with sudo, I will be asked to enter the current user's password. After that for a while, if I execute the same sort of commands with sudo, I won't be asked for the password again. So my guess is that the password is cached somewhere until it expires. How long is this expiration time? Is it possible to configure it?

share|improve this question
1  
Just fyi, you can prompt to extend the expiration using sudo -v. This is great for putting at the top of scripts that run sudo commands so that you're asked for the password at the beginning. –  valbaca Jun 16 '13 at 6:46

2 Answers 2

up vote 16 down vote accepted

man 5 sudoers informs us that there is an option timestamp_timeout:

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s time stamp will never expire. This can be used to allow users to create or delete their own time stamps via “sudo -v” and “sudo -k” respectively.

So yes, it can be configured via /etc/sudoers, and by default it expires after 5 minutes.

share|improve this answer
4  
and you know, use visudo to edit sudo configuration, NEVER edit /etc/sudoers directly. –  Carlos Campderrós May 28 '13 at 10:12
2  
@CarlosCampderrós: True that. And (where possible) always keep another root shell open to be on the safe side. :) –  Ulrich Schwarz May 28 '13 at 14:34

That depends on your configuration. The default on most distributions (and in the source) is 5 minutes, but you can change it with the timestamp_timeout option in /etc/sudoers. From man sudoers:

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s time stamp will never expire. This can be used to allow users to create or delete their own time stamps via "sudo -v" and "sudo -k" respectively.

For example, to set the timeout for user chris to 20 minutes, add the following to /etc/sudoers, or in a file in /etc/sudoers.d (note: both the order of rules in these files and the order of these files matters, make sure it is not unintentionally overridden by a rule which is executed later):

Defaults:chris timestamp_timeout=20
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.