sudo config for two users:
mary ALL = (ALL) NOPASSWD: /bin/ls, /bin/cat bob ALL = (ALL) PASSWD: /bin/sort
Now, when user
mary executes any command not in the list she has to authenticate every time.
$ sudo sort [sudo] password for mary: Sorry, user mary is not allowed to execute '/bin/sort' as root on eagle.
mary were to again try to execute some other disallowed command, she would be asked for the password. However, this is not true for
bob, who gets asked only once and till the timeout period. Why does
mary have to authenticate again and again when she has already been able to correctly supply her password in the recent past?
I did find at least one similar question but the answers/comments don't seem to clarify enough. There the issue was with entering password on
sudo -v and here it is about commands not allowed by the config. Yes, the interaction of rules with
NOPASSWD tags is a similarity.