25

If I do the following:

sudo su -
//enter password
exit
exit
//login again straight away
sudo su -

The second invocation of sudo does not request a password because even though I have logged out again, I am still within some time limit meaning that I do not need to be prompted for my password again.

Because I am trying out some new privs to make sure they work, this is really slowing me down while I wait for the timeout to happen.

Is there a command I can run to reset the timeout?

I don't want to change the timeout or affect other users, by the way!

  • If you still cannot force sudo to prompt for password, you may also need to comment user rules mentioning "NOPASSWD" if they are present in /etc/sudoers.d/ directory. I have the line #includedir /etc/sudoers.d in /etc/sudoers and though that the line is disabled by a comment but it looks like the # before includedir is not read as a comment! – baptx 2 days ago
38

sudo -k Will kill the timeout timestamp. You can even put the command afterwards, like sudo -k test_my_privileges.sh

From man sudo:

-K The -K (sure kill) option is like -k except that it removes the user's time stamp entirely and may not be used in conjunction with a command or other option. This option does not require a password.

-k When used by itself, the -k (kill) option to sudo invalidates the user's time stamp by setting the time on it to the Epoch. The next time sudo is run a password will be required. This option does not require a password and was added to allow a user to revoke sudo permissions from a .logout file.

You can also change it permanently. From man sudoers:

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user's timestamp will never expire. This can be used to allow users to create or delete their own timestamps via sudo -v and sudo -k respectively.

  • 2
    Take care sudo -k command will not remove the credentials. It just ignores the current credentials and does not store them. – user1346466 Aug 31 '16 at 9:04
  • Just to add to this. If you want to change the timestamp timeout, you need to edit the sudoers file with sudo visudo. Then you add the line Defaults timestamp_timeout = 0 at the end of the list of other Defaults in the file. Take the line out again to revert back to "normal" timeout. – Floris Aug 22 '17 at 20:02
  • My followup-question: unix.stackexchange.com/q/416039/26152 – UlfR Jan 10 '18 at 10:39
5

Shawn's answer is great but there is an additional configuration option that might be useful in this situation.

From man sudoers:

tty_tickets

If set, users must authenticate on a per-tty basis. With this flag enabled, sudo will use a file named for the tty the user is logged in on in the user's time stamp directory. If disabled, the time stamp of the directory is used instead.

This flag is on by default.

From man sudo:

When the tty_tickets option is enabled in sudoers, the time stamp has per-tty granularity but still may outlive the user's session. On Linux systems where the devpts filesystem is used, Solaris systems with the devices filesystem, as well as other systems that utilize a devfs filesystem that monotonically increase the inode number of devices as they are created (such as Mac OS X), sudo is able to determine when a tty-based time stamp file is stale and will ignore it. Administrators should not rely on this feature as it is not universally available.

I think its relatively new. If your system supports it, if you logout then login, sudo will request your password again. (I have sudo -K in my shells logout script too.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.