11

Context

I like to work in public on my laptop, but I also like to use sudo without a password. Based on what I know now, I would use the NOPASSWD option in my sudoers file, but of course anyone could use sudo as they wish.

One important thought that comes to my mind is that locking programs exist. However, I would prefer using a flash drive (and using it just for sudo) because (1) it is faster, (2) easier than entering my password, and (3) I am not concerned with people accessing my content nor doing nefarious things: the laptop would be in public around other people, and the only intellectual property on my laptop is a very basic Angular project.

Additionally, myself and others may wish to prevent misuse of sudo on a computer not running an X or Wayland environment. My current work requires a modern web browser, but if I ever have the chance to not use X and just use a multiplexer, I do that -- my laptop is a bit old and slow.

Question

What I would like to do is put a keyfile on a flash drive, and simply plug in the flash drive when I am at the laptop, and take it out when I step away from it.

So here are my three questions derived from this problem:

  1. Is this possible with sudo as is?
  2. If not, would I be able to write a program that lets me do this?
  3. If so, what language might be the best to write this program?

(4. [Perhaps an extraneous question] Could this package be separate or would it need to be a fork of sudo?)

Note

If it is relevant, my setup is Arch Linux with bspwm, no desktop environment. Most of my work is web development in urxvt / vim and checking it with Chrome.

7
  • 1
    Does pam_usb meet your needs?
    – StrongBad
    Nov 14 '17 at 19:31
  • @StrongBad Oh...yep. It looks like it doesn't immediately do just sudo, and does login and sudo together, but that doesn't matter to me. Thanks! Nov 14 '17 at 19:40
  • 2
    Okay, to clarify, you want to stay logged in constantly and just prevent people from using sudo under your account.
    – StrongBad
    Nov 14 '17 at 19:44
  • @StrongBad Correct. Nov 14 '17 at 19:57
  • You might be able to configure something using the rootpw flag in the /etc/sudoers files and setting up pam_usb for root login. Nov 15 '17 at 0:43
3

I'm not sure I understand why the NOPASSWD option doesn't satisfy your requirements all by itself, but if you want to require the presence of the flash drive I can think of something that might almost do what you're looking for.

This is more of a workaround, but you could create a local administrative user, say superuser, and give that user passwordless sudo rights, i.e. add the following line to your /etc/sudoers file:

superuser ALL=(ALL) NOPASSWD:ALL

You could then disable password login and configure key-only SSH authentication for that user, i.e. run passwd -l superuser and add the following stanza to your /etc/ssh/sshd_config:

Match user superuser
PasswordAuthentication no

Then create an SSH key-pair for this user. Add the public key to /home/superuser/.ssh/authorized_keys and put the private key on your flash drive. Then when you want to use the superuser account, plug in your flash-drive and ssh into the superuser account using your private key. And voilà! You now have passwordless sudo for your user. Of course you'll still need to exit your shell sessions when you're done - unplugging the flash drive won't be enough. Although I guess you could also setup a precommand hook to check for the private key and exit automatically if it isn't present (or if it's invalid).

1
  • an easy answer to clear up as to why you might want to do this. for this server im trying to get back into, i only have the root key, no root ssh access, im locked into the ec2-user, which sudo is asking a pw i dont have. i scp'd my root key to the server, so i would ideally now like to use this key to gain sudo acces, then i can fix things. Mar 13 '19 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.