2

The centos documentation stated that:

... In the PAM timestamp scheme, the graphical administrative application prompts the user for the root password when it is launched. When the user has been authenticated, the pam_timestamp.so module creates a timestamp file. By default, this is created in the /var/run/sudo/ directory. If the timestamp file already exists, graphical administrative programs do not prompt for a password. Instead, the pam_timestamp.so module freshens the timestamp file, reserving an extra five minutes of unchallenged administrative access for the user.

You can verify the actual state of the timestamp file by inspecting the /var/run/sudo/ file. For the desktop, the relevant file is unknown:root. If it is present and its timestamp is less than five minutes old, the credentials are valid. ...

I then check the file, it's binary format:

[xiaobai@xiaobai note]$ sudo cat /var/run/sudo/ts/xiaobai 
(�r�3�+�[xiaobai@xiaobai note]$ 
[xiaobai@xiaobai note]$ sudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  06 34 00 00 00 00 00 00  4e a7 c9 3a 00 00 00 00  |.4......N..:....|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$
...
[xiaobai@xiaobai note]$
(�ry5S�V�[xiaobai@xiaobasudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  af 35 00 00 00 00 00 00  5d 1a 24 07 00 00 00 00  |.5......].$.....|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$

and the number slowly increase from 4 and 5 and i though it's minute. By i might be wrong because i noticed when it reached 9, it seems like longer than 1 minute. And after 9, it become more and more unreadable:

xiaobai@xiaobai note]$ sudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  30 3b 00 00 00 00 00 00  59 f9 63 32 00 00 00 00  |0;......Y.c2....|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$ sudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  32 3b 00 00 00 00 00 00  ad 72 8f 1b 00 00 00 00  |2;.......r......|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$ 

So my 1st question is, how should i inspecting the /var/run/sudo/user file which was in the binary format? The doc stated that "If it is present and its timestamp is less than five minutes old, the credentials are valid." How this <5 minutes information represented in this binary format?

And my 2nd question, does PAM timestamp(pam_timestamp.so) and timestamp_timeout(/etc/sudoers) is the same thing?

p/s: I tested it in Fedora 21.

3

If you follow the next link on the documentation page: http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-pam-timestamp-remove.html you can find a reference to the pam_timestamp_check utility.

The pam_timestamp_check utility will check the validity of the file and the return value can be checked.

See also man pam_timestamp_check for details.

On my system (Linux Mint) I also found out that pam_timestamp_check always returns exit code 7 - Timestamp is not valid. Using strace pam_timestamp_check to debug the process it returns exit code 2 - The binary is not setuid root. After making the binary setuid using chmod u+s /usr/bin/strace I was able to trace the process:

lambert # strace pam_timestamp_check root
.
.
lstat("/var/run/sudo/lambert/9:root", {st_mode=S_IFREG|0600, st_size=57, ...}) = 0
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
exit_group(7)                           = ?
+++ exited with 7 +++

From this output I can see that /var/run/utmp is checked and can not be found.

Searching on my filesystem turns out that the utmp file is located in /run/utmp instead of /var/run/utmp. After creating the file using:

touch /var/run/utmp
chmod 664 /var/run/utmp
chown root:utmp /var/run/utmp

I was able to start a fresh sudo session (from a new terminal):

lambert $ sudo su
lambert # ls -l /var/run/utmp
-rw-rw-r-- 1 root utmp 384 mei 12 21:59 /var/run/utmp
#logout
lambert $ pam_timestamp_check root
lambert $ echo $?
0
  • but why pam_timestamp_check; echo $? always return me 7 regardless of sudo require prompt for password or not ? 7 means "Timestamp is not valid." refer to manual. And how can i know the remaining minutes by using pam_timestamp_check? – 林果皞 May 12 '15 at 18:30
  • 1
    I am not absolutely sure but you might use the timestamp (modification time) of the timestamp file itself. It is created when succesfully authenticated and if you substract the modification time from the current time you will have the elapsed time. When you substract the elapsed time from the timeout (default 15 minutes) you will have the remaining time. – Lambert May 12 '15 at 19:07
  • 1
    And yes, it is strange that the pam_timestamp_check always returns 7 - Timestamp is not valid... I can reproduce that on Linux Mint. From other sources (where the pam_timestamp is not configured) sudo caches using a different method, please read forums.linuxmint.com/viewtopic.php?f=90&t=177339 – Lambert May 12 '15 at 19:09
  • I think I got it... see my updated answer and try if that is applicable to your environment too – Lambert May 12 '15 at 20:02
  • 1
    I check my Fedora 21 it have error of no such file "/var/run/sudo/xiaobai/0"(instead i have /var/run/sudo/ts/xiaobai). And actually i only have one file, i.e. /var/run/sudo/ts/xiaobai. So i wonder how can the system know which session keep its own sudo timestamp ? e.g. open new terminal tab and sudo. If there's only one file(i.e. /var/run/sudo/ts/xiaobai) and only one mtime exist, how can i substract the mtime because there's multiple terminal tab sessions while only one mtime? – 林果皞 May 13 '15 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.