9

This question already has an answer here:

What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a privileged command. I understand the security risk which requires us to reenter a password when we've been away for awhile but it seems like login should automatically set this session by default to prevent this but it doesn't for some reason.

I am aware of these solutions but they both rely on gdm and I appear to only have LightDM installed for starters. Furthermore, I don't login to a GUI interface and AFAIK the console doesn't use either of these to manage logins in the first place.

I'm using Ubuntu 13.04 in VMware if that matters. I do have a KDE installed but I don't usually load it unless I have a reason to.

The ideal solution would also work from SSH logins.

Update:

Based on Gilles' suggestions I now have this working setup:

~ tail -n1 /etc/pam.d/sshd
session optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket

and (be sure to use sudo visudo to edit sudoers)

~  sudo head -n12 /etc/sudoers|tail -n1
Defaults        !tty_tickets

and create a new script

~ cat /usr/local/sbin/update_sudo_ticket
#!/bin/sh
touch -c "/var/lib/sudo/$PAM_USER" 2>/dev/null

and make it executable ( sudo chmod u=+rwx,g=+rx-w,o=-rwx /usr/local/sbin/update_sudo_ticket ):

~  ls -la /usr/local/sbin/update_sudo_ticket
-rwxr-x--- 1 root root 57 Sep 21 20:52 /usr/local/sbin/update_sudo_ticket

marked as duplicate by Anthon, slm Apr 10 '16 at 22:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Why don't you just log in as root if you know that you want use privileged commands? – Martin von Wittich Sep 21 '13 at 18:45
  • 1
    My root passwords are very long auto generated hash strings. I don't make my user account passwords as complex. Also, at least two of my servers have multiple users in our team whom are able to log in and I don't want to give everyone the root account. Even though these are dev\testing servers they could potentially cause me hours and hours of work fixing something if they mess it up. I use the white list feature of sudo so that these users don't have completely unfettered access. If that is the only alternative then they'll just need to keep entering a second password. – krowe Sep 21 '13 at 21:32
7

You can use pam_exec to invoke an external command. Beware that pam_exec runs in an environment that is under the control of the user who calls the login service, so don't invoke it from su, only from services with a predictable environment such as sshd or login.

sudo has no option to update a user's time stamp, only to remove it. So you'll have to update the time stamp manually. If you aren't using the tty_tickets option (which is not very useful), all you need to do is update the timestamp on the directory.

session optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket

where /usr/local/sbin/update_sudo_ticket is something like

#!/bin/sh
touch -c "/var/lib/sudo/$PAM_USER" 2>/dev/null
  • Would i add that to /etc/pam.d/login and /etc/pam.d/sshd then? Just on the end I suppose. – krowe Sep 22 '13 at 1:49
  • @krowe Yes, that's the idea. – Gilles Sep 22 '13 at 1:57
  • Not quite working I'm afraid. See my update. – krowe Sep 22 '13 at 2:20
  • Found the problem. I had forgotten to update the sudoers file. – krowe Sep 22 '13 at 3:05
  • 1
    @PiotrDobrogost sudo -V | grep 'timestamp dir' – Gilles Feb 23 '14 at 20:23
-2

Edit your /etc/sudoers file with visudo and add this line:

%wheel ALL=(ALL) NOPASSWD: ALL

Then make sure your user is part of group wheel:

usermod -a -G wheel USERNAME_HERE
  • This isn't what the OP asked for: they want to trigger the grace time, not forgo the password entirely (for every user in wheel)... – jasonwryan Sep 21 '13 at 21:47
  • Yes, this isn't the same as what I was wanting. OTOH, if no one can give me solution which works the way I've asked for this is definitely a workable alternative. The wheel group had completely slipped my mind. It won't work for every server but on most it'd be fine. – krowe Sep 21 '13 at 22:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.