0

I observe this issue below:

abc@ubuntu:~$ sudo - i 
[sudo] password for abc: 
sudo: -: command not found
abc@ubuntu:~$ sudo -i
root@ubuntu:~#

sudo command seems to fail with error "command not found", however for next sudo attempt with correct option, it got root login but this time it didn't ask for password. Why this strange behavior?

I am asking this question from security view of point. Notice that after "command not found" the user is still "abc" which may not be admin. He/She can get the "root" privileges without even knowing the sudo password by simply issuing "sudo -i" within 15 minutes(cached password time). Isn't it?

Improve this question
3
  • Simple typo of a space before the i
    – Jeff Schaller ♦
    Nov 23, 2016 at 21:11
  • no strange behavior, sudo remembers (correctly) entered passwords.
    – Timothy Truckle
    Nov 23, 2016 at 21:12
  • sudo - i means you want to execute a program called - and pass it the argument i as root.
    – Red Cricket
    Nov 23, 2016 at 21:15

2 Answers 2

Reset to default
3

In the first case, the shell thinks that there is a command after sudo that you are trying to run, - , because there is no such a command, the shell tells you that command was not found. When running a command preceded with sudo , by default, it will ask your password.

In the second case, the shell recognizes that you are running sudo command with -i option. The password is not asked again because you just typed it correctly when you tried to run the first command. (by default it caches credentials for 15 minutes)

Improve this answer
2
  • That sounds reasonable but if sudo is throwing message "command not found" which seems an error, shouldn't it discard the caching of password even if it is correct.
    – Mukul Sharma
    Nov 23, 2016 at 21:21
  • 2
    Actually, sudo itself run without an error, so I don't really see any reason for that. The error happened when command - was not found
    – jiipeezz
    Nov 23, 2016 at 21:26
0 
$man sudo
...
Security policies may support credential caching
to allow the user to run sudo again for a period
of time without requiring authentication.  The sudoers
policy caches credentials for 15 minutes, unless
overridden in sudoers(5).  By running sudo with
the -v option, a user can update the cached credentials
without running a command.
Improve this answer
4
  • 1
    That sounds reasonable but if sudo is throwing message "command not found" which seems an error, shouldn't it discard the caching of password even if it is correct.
    – Mukul Sharma
    Nov 23, 2016 at 21:20
  • 1
    @MukulSharma "shouldn't it discard the caching of password even if it is correct" where is the connection between "command misspelled" and "not allowed to act as a superuser"?
    – Timothy Truckle
    Nov 23, 2016 at 21:21
  • I am asking this question from security view of point. Notice that after "command not found" the user is still abc which may not be "root". He can get the "root" privileges without even knowing the sudo password by simply issuing "sudo -i" within 15 minutes. Isn't it?
    – Mukul Sharma
    Nov 23, 2016 at 21:31
  • 1
    @MukulSharma "He can get the "root" privileges without even knowing the sudo password by simply issuing "sudo -i" within 15 minutes" as the attacker can after a successful "sudo" command as well, this has nothing to do with the misspelled command.
    – Timothy Truckle
    Nov 23, 2016 at 21:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .