We can modify sudo caching time with the option: timestamp_timeout
How insecure is that? I wanted to increase it to several hours (the time of my sessions)
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
The caching time of
sudo is a compromise between security and convenience.
If the time is short you have to enter your password more frequently, making sure the terminal is still being used by the authorized user. This might get annoying for the users but is more secure because if a user leaves his terminal unlocked, an unauthorized person can only compromise this user's data.
If the time interval is longer, therer is a greater chance that someone leaves his terminal unlocked allowing some unauthorized person to compromise the whole system using
The decision is up to you.
An unauthorized person in this case can be anyone walking by and accessing the computer or a remote terminal connected to it when the logged in user has left his terminal without locking it.
With a remote terminal (e.g. ssh connection, X11, VNC ...) this doesn't require physical access to the system itself, physical or remote access to the remote computer or terminal would be sufficient.
If someone has physical access to the computer itself he might be able to do anything by booting from a CD/DVD/USB stick or by connecting the harddisk to a different computer. Of course, entering a malicious
sudo command is much easier to do and more difficult to detect than physically manipulating the computer.