20

I am the only user of my Linux Mint system and I noticed that the password I chose to login is the same that got assigned to sudo.

So my question is: Will changing my login password also change the sudo password?

If not, how can I change the sudo password?

  • 5
    It isn't the sudo password, it's your password. – immibis Feb 13 '17 at 21:38
44

By default, sudo asks for the user password. Thus, changing the user password (which is also used for login), will also affect sudo invocations.

However, you can set in the /etc/sudoers for your user the rootpw flag, in which case it would ask for the root password instead.

The relevant excerpt from the sudoers(5) man page is:

Authentication and logging
 The sudoers security policy requires that most users authenticate them‐
 selves before they can use sudo.  A password is not required if the
 invoking user is root, if the target user is the same as the invoking
 user, or if the policy has disabled authentication for the user or com‐
 mand.  Unlike su(1), when sudoers requires authentication, it validates
 the invoking user's credentials, not the target user's (or root's) cre‐
 dentials.  This can be changed via the rootpw, targetpw and runaspw
 flags, described later.

Similarly, the keyword for not requesting a password for sudo is NOPASSWD.

If you want to set the root password, you can use sudo passwd

Note that when changing sudo permissions, it is recommended to keep a root console open (eg. sudo -s) until it is verified in a different terminal that it indeed works, and you haven't locked out yourself.

  • 1
    And you can specify that a user (or group of users) may use sudo without being prompted for their password at all. – Baard Kopperud Feb 13 '17 at 0:09
  • 9
    You should also mention how to set the root password. Configuring sudo to require the root password without first setting the root password could be problematic. – kasperd Feb 13 '17 at 1:07
  • 4
    While this is true, it's generally considered a bad idea to have a "root password" known to administrators. Consider how much damage could be done by an administrator who changed it and then left. Best practices generally call for administrators to be members of a group (such as "wheel") in /etc/sudoers that can elevate to root by using their own password, rather than a shared password. – Monty Harder Feb 13 '17 at 22:16
  • 1
    @MontyHarder that's the same harm the same rogue administrator could do removing everyone from the wheel group or changing the contents of /etc/sudoers The main benefit is not to avoid evil administrators (you are giving them root!) but avoiding direct logins as root (thus keeping a log of actions). – Ángel Feb 14 '17 at 0:49
  • @kasperd, BaardKopperud: added – Ángel Feb 14 '17 at 1:04
22

There's no sudo password on its own. A user can belong to the sudo group and run the sudo command, but each user has only one password. When it changes, it changes for the user not any application in particular.

Another similar misconception is that the root password is the same as one used for sudoing. No, root is a single user and has a private password, which has nothing to do with any other password.

  • 8
    That's how sudo is usually configured by default. But that configuration can be changed. – kasperd Feb 13 '17 at 1:05
  • 1
    Or wheel group – l0b0 Feb 13 '17 at 8:34
3

Yes, sudo uses the same "password database" (usually /etc/shadow for a small system) as login.

  • 1
    On sane systems, certainly. But since sudo can have a separate pam.d/ config, not-so-sane systems might exist that do things like "login with kerberos/ldap auth, yet sudo with local password database". (Yes, this will not apply to the OP's single-user Mint.) – Ulrich Schwarz Feb 13 '17 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.