0

When I use sudo to install some software, update my system or any other action requiring my consent (i.e. to say y or n before the system can proceed), I am asked to approve the operation just the first time. If after that I decide to use sudo again it will not ask for my approval, and will just execute the task.

So my question is: why is that and how can I make it always ask for my approval?

7

From man sudoers

 sudoers uses time stamp files for credential caching.  Once a user has
 been authenticated, the time stamp is updated and the user may then use
 sudo without a password for a short period of time (5 minutes unless
 overridden by the timeout option). 

 timestamp_timeout
                   Number of minutes that can elapse before sudo will ask
                   for a passwd again.  The timeout may include a frac-
                   tional component if minute granularity is insufficient,
                   for example 2.5.  The default is 5.  Set this to 0 to
                   always prompt for a password.  If set to a value less
                   than 0 the user's time stamp will never expire.  This
                   can be used to allow users to create or delete their
                   own time stamps via ``sudo -v'' and ``sudo -k'' respec-
                   tively.

This means you can run visudo and add this line:

Defaults timestamp_timeout=0

With that value we can see there's no credential caching:

$ sudo id
[sudo] password for sweh: 
uid=0(root) gid=0(root) groups=0(root)
$ sudo id
[sudo] password for sweh: 
uid=0(root) gid=0(root) groups=0(root)
$ 
4

Sudo memorizes your password for a given time (default 5 minutes). Some people find that convenient for some times when they enter many sudo prefixed commands in a row. You can disable this feature by editing (as root) the file /etc/sudoers and changing

timestamp_timeout=N

to

timestamp_timeout=0

Later if you find yourself wanting to do many commands as root you can always enter sudo su which will open a new shell as root.

credit: https://scottlinux.com/2012/08/04/change-sudo-default-password-timeout/

  • 4
    Or sudo -s which will open a shell directly (without su). – Stephen Kitt Sep 18 '16 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.