39

When I run sudo and enter my password, a subsequent invocation of sudo within a few minutes will not need the password to be re-entered.

How can I change the default timeout to require the password again?

52

man sudoers says:

Once a user has been authenticated, [...] the user may then use sudo without a password for a short period of time (5 minutes unless overridden by the timestamp_timeout option).

To change the timeout, run, sudo visudo and add the line:

Defaults        timestamp_timeout=30

where 30 is the new timeout in minutes.

To always require a password, set to 0. To set an infinite timeout, set the value to be negative.

To totally disable the prompt for a password for user ravi:

Defaults:ravi      !authenticate
0
16

sudo visudo is to modify the default configuration file directly, but in the file has suggestion below

Please consider adding local content in /etc/sudoers.d/ instead of directly modifying this file.

So, better way is

cd /etc/sudoers.d
sudo visudo -f user_name

Add the content

Defaults timestamp_timeout=(number)

(number) is the new timeout in minutes.

timestamp_timeout (man 5 sudoers)

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 15. Set this to 0 to always prompt for a password. If set to a value less than 0 the user's time stamp will not expire until the system is rebooted. This can be used to allow users to create or delete their own time stamps via “sudo -v” and “sudo -k” respectively.

Save the file by pressing Ctrl + O and press enter, and exit using Ctrl + X.

1
  • Good catch.. +1 to you as well. Yes, "conf.d" format/type areas are always the best and preferred way to edit system/service configs (when it's available).
    – B. Shea
    Oct 1 at 16:56
5

You need to edit /etc/sudoers. For those who don't use vi, you should edit this file (on some flavors of Linux) with a terminal command like this:

sudo EDITOR=gedit visudo

Then add or change timestamp_timeout:

# After authenticating, this is the amount of time after which
# sudo will prompt for a password again in the same terminal
Defaults    timestamp_timeout=30
3
  • 1
    The right™ way to avoid vi, would be setting the $EDITOR variable to something else. The idea of visudo is not to call vi, but to keep people from locking themselves (and anyone else depending on sudo) out of their root account by 1) copying /etc/sudoers to a temporary file, 2) calling $EDITOR on this file, 3) running a syntax check on this file and 4) eventually replacing /etc/sudoers with the updated version. Jan 22 '19 at 22:34
  • visudo's documentation says this: "Normally, visudo does not honor the VISUAL or EDITOR environment variables unless they contain an editor in the aforementioned editors list" - and the list defaults to only vi, while allowing any editor is said to be a security hole. But I can confim that sudo EDITOR=gedit visudo works on my CentOS 7.2 box. The syntax check it provides is certainly a Good Thing.
    – Qwertie
    Jan 22 '19 at 22:56
  • Ah, yeah, thank you for the (further) clarification, I missed that. But IIRC you can also change the default editor in sudoers itself - just for the record. I'm sure the syntax check will tell. ;) Jan 22 '19 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.