What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a privileged command. I understand the security risk which requires us to reenter a password when we've been away for awhile but it seems like login should automatically set this session by default to prevent this but it doesn't for some reason.

I am aware of these solutions but they both rely on gdm and I appear to only have LightDM installed for starters. Furthermore, I don't login to a GUI interface and AFAIK the console doesn't use either of these to manage logins in the first place.

I'm using Ubuntu 13.04 in VMware if that matters. I do have a KDE installed but I don't usually load it unless I have a reason to.

The ideal solution would also work from SSH logins.


Based on Gilles' suggestions I now have this working setup:

~ tail -n1 /etc/pam.d/sshd
session optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket

and (be sure to use sudo visudo to edit sudoers)

~  sudo head -n12 /etc/sudoers|tail -n1
Defaults        !tty_tickets

and create a new script

~ cat /usr/local/sbin/update_sudo_ticket
touch -c "/var/lib/sudo/$PAM_USER" 2>/dev/null

and make it executable ( sudo chmod u=+rwx,g=+rx-w,o=-rwx /usr/local/sbin/update_sudo_ticket ):

~  ls -la /usr/local/sbin/update_sudo_ticket
-rwxr-x--- 1 root root 57 Sep 21 20:52 /usr/local/sbin/update_sudo_ticket
  • 1
    Why don't you just log in as root if you know that you want use privileged commands? Commented Sep 21, 2013 at 18:45
  • 1
    My root passwords are very long auto generated hash strings. I don't make my user account passwords as complex. Also, at least two of my servers have multiple users in our team whom are able to log in and I don't want to give everyone the root account. Even though these are dev\testing servers they could potentially cause me hours and hours of work fixing something if they mess it up. I use the white list feature of sudo so that these users don't have completely unfettered access. If that is the only alternative then they'll just need to keep entering a second password.
    – krowe
    Commented Sep 21, 2013 at 21:32

2 Answers 2


You can use pam_exec to invoke an external command. Beware that pam_exec runs in an environment that is under the control of the user who calls the login service, so don't invoke it from su, only from services with a predictable environment such as sshd or login.

sudo has no option to update a user's time stamp, only to remove it. So you'll have to update the time stamp manually. If you aren't using the tty_tickets option (which is not very useful), all you need to do is update the timestamp on the directory.

session optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket

where /usr/local/sbin/update_sudo_ticket is something like

touch -c "/var/lib/sudo/$PAM_USER" 2>/dev/null
  • Would i add that to /etc/pam.d/login and /etc/pam.d/sshd then? Just on the end I suppose.
    – krowe
    Commented Sep 22, 2013 at 1:49
  • @krowe Yes, that's the idea. Commented Sep 22, 2013 at 1:57
  • Not quite working I'm afraid. See my update.
    – krowe
    Commented Sep 22, 2013 at 2:20
  • Found the problem. I had forgotten to update the sudoers file.
    – krowe
    Commented Sep 22, 2013 at 3:05
  • 1
    @PiotrDobrogost sudo -V | grep 'timestamp dir' Commented Feb 23, 2014 at 20:23

Edit your /etc/sudoers file with visudo and add this line:


Then make sure your user is part of group wheel:

usermod -a -G wheel USERNAME_HERE
  • This isn't what the OP asked for: they want to trigger the grace time, not forgo the password entirely (for every user in wheel)...
    – jasonwryan
    Commented Sep 21, 2013 at 21:47
  • Yes, this isn't the same as what I was wanting. OTOH, if no one can give me solution which works the way I've asked for this is definitely a workable alternative. The wheel group had completely slipped my mind. It won't work for every server but on most it'd be fine.
    – krowe
    Commented Sep 21, 2013 at 22:15

Not the answer you're looking for? Browse other questions tagged .