26

If I run a command which requires root privileges with sudo, I will be asked to enter the current user's password. After that for a while, if I execute the same sort of commands with sudo, I won't be asked for the password again. So my guess is that the password is cached somewhere until it expires. How long is this expiration time? Is it possible to configure it?

2
  • 1
    Just fyi, you can prompt to extend the expiration using sudo -v. This is great for putting at the top of scripts that run sudo commands so that you're asked for the password at the beginning.
    – valbaca
    Jun 16 '13 at 6:46
  • 1
    Note sudo does not actually cache the password. Sudo does not actually need a password at all to do its job, it only askes so as to verify that the user allowed to run the given command. Basically it caches the users credentials for a period (as a special "timestamp", see top answer), during which it does not require the user to re-verify themselves. The password itself is not cached (stored), unlike a web browser or encryption keys.
    – anthony
    Nov 13 '17 at 23:13
22

man 5 sudoers informs us that there is an option timestamp_timeout:

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s time stamp will never expire. This can be used to allow users to create or delete their own time stamps via “sudo -v” and “sudo -k” respectively.

So yes, it can be configured via /etc/sudoers, and by default it expires after 5 minutes.

Also, please remember to use visudo to make any edits to /etc/sudoers. When saving your edits visudo will run validity checks before actually overwriting the sudoers file. This protects you from a painful recovery process if you lock yourself out of sudo access.

2
  • 5
    and you know, use visudo to edit sudo configuration, NEVER edit /etc/sudoers directly. May 28 '13 at 10:12
  • 2
    @CarlosCampderrós: True that. And (where possible) always keep another root shell open to be on the safe side. :) May 28 '13 at 14:34
9

That depends on your configuration. The default on most distributions (and in the source) is 5 minutes, but you can change it with the timestamp_timeout option in /etc/sudoers. From man sudoers:

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s time stamp will never expire. This can be used to allow users to create or delete their own time stamps via "sudo -v" and "sudo -k" respectively.

For example, to set the timeout for user chris to 20 minutes, add the following to /etc/sudoers, or in a file in /etc/sudoers.d (note: both the order of rules in these files and the order of these files matters, make sure it is not unintentionally overridden by a rule which is executed later):

Defaults:chris timestamp_timeout=20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.