5

I'm unclear on the terminology here, so please bear with me.

I use Tmux. I sudo foo in my current pane. It prompts for my password; I enter it. Now, for a while, the pane doesn't have to prompt again for my password when I sudo things.

However, if I make a new pane in the current window (e.g. to edit a file while keeping the original pane visible), and I sudo bar, it will prompt for my password again.

Is there a way to pass the "sudo unlocked" state of the first pane to the second one at the moment I create it?

For what it's worth, my shell is Zsh.

To be clear: I'm expecting a Tmux answer here, perhaps a way to change my window-splitting bindings to execute some command upon creating a pane. But I'd also be interested in other ways to configure this behaviour.

|improve this question
  • 2
    Research material: man 5 sudoers, search for tty_tickets. It looks like you can configure sudo to keep a single ticket for all your panes and everything else. But you want to escalate the new pane only, right? I expect it's hard to trick sudo it runs under the same controlling terminal as the old pane. Let's suppose you can do this somehow. Then sudo will spawn the actual command with "counterfeit" terminal. But you need the command itself to use the new tty (especially in your example, where you want to edit a file interactively), so you should trick it "back" in a similar way. – Kamil Maciorowski Aug 21 '19 at 9:32
12

On your system, once sudo has authenticated you, the authentication is tied to the particular TTY that you ran sudo from. Each pane in tmux has its own TTY.

sudo on your system uses the tty_ticket option by default, or it uses timestamp_type=tty (possibly not explicitly as it is the default). These settings are documented in the sudoers manual:

tty_tickets

If set, users must authenticate on a per-tty basis. With this flag enabled, sudo will use a separate record in the time stamp file for each terminal. If disabled, a single record is used for all login sessions.

This option has been superseded by the timestamp_type option.

timestamp_type

sudoers uses per-user time stamp files for credential caching. The timestamp_type option can be used to specify the type of time stamp record used. It has the following possible values:

The values are global, ppid, tty (default), and kernel (see the sudoers manual for a description of each of these).

You may want to modify your sudoers configuration (via the visudo command) to either include

Defaults !tty_tickets

or

Defaults timestamp_type=global

Either of these would tie the authentication to your current login session rather than to a particular TTY.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.