In addition to Gilles' answer to the
Can I block non-interactive sudo invocation? aspect of your question, I would suggest a work-around for this particular element of your situation:
I don't like typing the password for sudo so I disabled it
Now I have a bad side effect that any shell script I run can silently execute sudo on my behalf.
If your situation is that you normally
sudo a bunch of various commands, but then you find yourself executing scripts that silently execute sudo to where you aren't prompted for a password to realize that root-level things are happening, you could:
- Take the NOPASSWD option back out
- Extend the timestamp timeout beyond the stock 5 minutes to be a longer period of time
- Kill the sudo timestamp before running an untrusted script
You already know how to edit sudoers for the
To extend the
timestamp_timeout in the sudoers file, set it to either a really high value or a negative value. Relevant snippets from the manual page for that parameter:
Number of minutes that can elapse before sudo will ask for a passwd again.
The default is 5.
If set to a value less than 0 the user's time stamp will not expire until the system is rebooted.
When you find yourself about to execute a script that you're not sure of, simply run
sudo -k to "kill" the timestamp:
When used without a command, invalidates the user's cached credentials. In other words, the next time sudo is run a password will be required.
If you run a script and find yourself being prompted by sudo for your password, you'll know that
sudo was invoked and would be able to interrupt the script if you wanted.
As an aside here, I recommend setting the passprompt parameter to include the text
sudo in it, such as:
Defaults passprompt="[sudo] password for %u:"
... so that it's obvious if/when sudo is prompting for your password (versus any other tool).