0

We can modify sudo caching time with the option: timestamp_timeout

How insecure is that? I wanted to increase it to several hours (the time of my sessions)

closed as primarily opinion-based by Jeff Schaller, Christopher, Stephen Kitt, Stephen Harris, Sparhawk Feb 6 at 8:26

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You're asking us to assign risk to your environment. It's your system (presumably); what risk do you have now, and what do you imagine increasing the timeout will do? – Jeff Schaller Feb 5 at 16:40
0

The caching time of sudo is a compromise between security and convenience.

If the time is short you have to enter your password more frequently, making sure the terminal is still being used by the authorized user. This might get annoying for the users but is more secure because if a user leaves his terminal unlocked, an unauthorized person can only compromise this user's data.

If the time interval is longer, therer is a greater chance that someone leaves his terminal unlocked allowing some unauthorized person to compromise the whole system using sudo.

The decision is up to you.

An unauthorized person in this case can be anyone walking by and accessing the computer or a remote terminal connected to it when the logged in user has left his terminal without locking it.

With a remote terminal (e.g. ssh connection, X11, VNC ...) this doesn't require physical access to the system itself, physical or remote access to the remote computer or terminal would be sufficient.

If someone has physical access to the computer itself he might be able to do anything by booting from a CD/DVD/USB stick or by connecting the harddisk to a different computer. Of course, entering a malicious sudo command is much easier to do and more difficult to detect than physically manipulating the computer.

  • "allowing some unauthorized person " do you refer to someone who would access your system physically? like in a workspace? – pedrotester Feb 5 at 18:37
  • @pedrotester I updated my answer. – Bodo Feb 6 at 9:58
  • I think I'm gonna increase it then – pedrotester Feb 6 at 16:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.