36

If I do the following:

sudo su -
//enter password
exit
exit
//login again straight away
sudo su -

The second invocation of sudo does not request a password because even though I have logged out again, I am still within some time limit meaning that I do not need to be prompted for my password again.

Because I am trying out some new privs to make sure they work, this is really slowing me down while I wait for the timeout to happen.

Is there a command I can run to reset the timeout?

I don't want to change the timeout or affect other users, by the way!

1
  • If you still cannot force sudo to prompt for password, you may also need to comment user rules mentioning "NOPASSWD" if they are present in /etc/sudoers.d/ directory. I have the line #includedir /etc/sudoers.d in /etc/sudoers and though that the line is disabled by a comment but it looks like the # before includedir is not read as a comment!
    – baptx
    May 24, 2019 at 17:37

2 Answers 2

56

sudo -k Will kill the timeout timestamp. You can even put the command afterwards, like sudo -k test_my_privileges.sh

From man sudo:

-K The -K (sure kill) option is like -k except that it removes the user's time stamp entirely and may not be used in conjunction with a command or other option. This option does not require a password.

-k When used by itself, the -k (kill) option to sudo invalidates the user's time stamp by setting the time on it to the Epoch. The next time sudo is run a password will be required. This option does not require a password and was added to allow a user to revoke sudo permissions from a .logout file.
When used in conjunction with a command or an option that may require a password, this option will cause sudo to ignore the user's cached credentials. As a result, sudo will prompt for a password (if one is required by the security policy) and will not update the user's cached credentials.

You can also change it permanently. From man sudoers:

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user's timestamp will never expire. This can be used to allow users to create or delete their own timestamps via sudo -v and sudo -k respectively.

6
  • 5
    Take care sudo -k command will not remove the credentials. It just ignores the current credentials and does not store them. Aug 31, 2016 at 9:04
  • Just to add to this. If you want to change the timestamp timeout, you need to edit the sudoers file with sudo visudo. Then you add the line Defaults timestamp_timeout = 0 at the end of the list of other Defaults in the file. Take the line out again to revert back to "normal" timeout.
    – Floris
    Aug 22, 2017 at 20:02
  • 1
    My followup-question: unix.stackexchange.com/q/416039/26152
    – UlfR
    Jan 10, 2018 at 10:39
  • @user1346466 pls can you expand the explanation about your comment? Jan 6, 2022 at 21:00
  • @ManuelJordan just read the quoted sudo man page in the answer. Especially the second paragraph for the -k option. Apr 19, 2022 at 9:53
5

Shawn's answer is great but there is an additional configuration option that might be useful in this situation.

From man sudoers:

tty_tickets

If set, users must authenticate on a per-tty basis. With this flag enabled, sudo will use a file named for the tty the user is logged in on in the user's time stamp directory. If disabled, the time stamp of the directory is used instead.

This flag is on by default.

From man sudo:

When the tty_tickets option is enabled in sudoers, the time stamp has per-tty granularity but still may outlive the user's session. On Linux systems where the devpts filesystem is used, Solaris systems with the devices filesystem, as well as other systems that utilize a devfs filesystem that monotonically increase the inode number of devices as they are created (such as Mac OS X), sudo is able to determine when a tty-based time stamp file is stale and will ignore it. Administrators should not rely on this feature as it is not universally available.

I think its relatively new. If your system supports it, if you logout then login, sudo will request your password again. (I have sudo -K in my shells logout script too.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .