0

I observe this issue below:

abc@ubuntu:~$ sudo - i 
[sudo] password for abc: 
sudo: -: command not found
abc@ubuntu:~$ sudo -i
root@ubuntu:~# 

sudo command seems to fail with error "command not found", however for next sudo attempt with correct option, it got root login but this time it didn't ask for password. Why this strange behavior?

I am asking this question from security view of point. Notice that after "command not found" the user is still "abc" which may not be admin. He/She can get the "root" privileges without even knowing the sudo password by simply issuing "sudo -i" within 15 minutes(cached password time). Isn't it?

  • Simple typo of a space before the i – Jeff Schaller Nov 23 '16 at 21:11
  • no strange behavior, sudo remembers (correctly) entered passwords. – Timothy Truckle Nov 23 '16 at 21:12
  • sudo - i means you want to execute a program called - and pass it the argument i as root. – Red Cricket Nov 23 '16 at 21:15
3

In the first case, the shell thinks that there is a command after sudo that you are trying to run, - , because there is no such a command, the shell tells you that command was not found. When running a command preceded with sudo , by default, it will ask your password.

In the second case, the shell recognizes that you are running sudo command with -i option. The password is not asked again because you just typed it correctly when you tried to run the first command. (by default it caches credentials for 15 minutes)

  • That sounds reasonable but if sudo is throwing message "command not found" which seems an error, shouldn't it discard the caching of password even if it is correct. – Mukul Sharma Nov 23 '16 at 21:21
  • 2
    Actually, sudo itself run without an error, so I don't really see any reason for that. The error happened when command - was not found – jiipeezz Nov 23 '16 at 21:26
0
$man sudo
...
Security policies may support credential caching
to allow the user to run sudo again for a period
of time without requiring authentication.  The sudoers
policy caches credentials for 15 minutes, unless
overridden in sudoers(5).  By running sudo with
the -v option, a user can update the cached credentials
without running a command.
  • That sounds reasonable but if sudo is throwing message "command not found" which seems an error, shouldn't it discard the caching of password even if it is correct. – Mukul Sharma Nov 23 '16 at 21:20
  • 1
    @MukulSharma "shouldn't it discard the caching of password even if it is correct" where is the connection between "command misspelled" and "not allowed to act as a superuser"? – Timothy Truckle Nov 23 '16 at 21:21
  • I am asking this question from security view of point. Notice that after "command not found" the user is still abc which may not be "root". He can get the "root" privileges without even knowing the sudo password by simply issuing "sudo -i" within 15 minutes. Isn't it? – Mukul Sharma Nov 23 '16 at 21:31
  • @MukulSharma "He can get the "root" privileges without even knowing the sudo password by simply issuing "sudo -i" within 15 minutes" as the attacker can after a successful "sudo" command as well, this has nothing to do with the misspelled command. – Timothy Truckle Nov 23 '16 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.