-3

If you think about it, it is kind of silly that sudo asks for your password even if you just logged into the machine and entered your password.

I realize that sudo and /bin/login are two entirely different mechanisms, but it would be nice if sudo didn't ask for a password if your login session is less than, say, 30 seconds.

sudo doesn't ask for a password more than once every 5 minutes by default. Similar to setting your screen-saver to kick in after 5 minutes of inactivity, this is a reasonable default for sudo.

Is there a way to fake out sudo so that it thinks the timeout hasn't expired when I log in?

1
  • 12
    That sounds like a very bad practice. You're opening up everything connected with your session time to be a possible privilege escalation vector.
    – Hyppy
    Commented Apr 8, 2015 at 16:19

6 Answers 6

15

Here's a good reason to not do it: You don't always login with your password. You may be logging in with an SSH key. It may be a passwordless SSH key... and it may not be the right person who's using it.

By requiring you to enter a password at least once, the system is protected against such occurrences.

If you still want to hack it (which I strongly advise against), you could have something write a new timestamp to the appropriate file in /var/db/sudo/tomontime/ when you login. If you write a program that does it, you could set that program to run with NOPASSWD in the sudoers file, and chain it to your .profile.

I really sincerely do not recommend it.

0
6

sudo does have a mechanism for not asking for the password for either all commands or a certain subset. Simply prepend NOPASSWD: to the command declaration in /etc/sudoers (using visudo).

The problem with not requiring a password is that if a user's session is compromised, either physically or through some malicious script/application/etc, you want to make sure to limit the damage. sudo access without a password means that anyone and any application with the user's rights now has sudo access. In addition, you want users to be aware of what they are doing, and give them an extra nudge to be conscientious.

If you're going to set NOPASSWD, then, you're accepting that it has its risks.

6

If (as is the default) you have tty_tickets enabled then you will need to provide a password for each tty you are using sudo in. The timeouts for each tty are maintained updating a file named for the tty in your timestamp directory. If you have tty_tickets disabled then it's the timestamp of the directory which is used for all ttys.

On a CentOS system I have to hand the timestamp directory for my login) is

/var/db/sudo/iain

which has the permissions

drwx------. 2 root iain  4096 Aug 18  2014 iain

examining it's contents

-rw-------. 1 root iain 48 Apr  8 17:34 0
-rw-------. 1 root iain 48 Mar 21 17:05 1
-rw-------. 1 root iain 48 Apr  5 09:04 2

The only way to do wat you want is to update the timestamp on the relevant file, and as you can see you can't without being root which I guess answers your question.

2
  • 2
    I am not at all convinced it would be a good idea, but there is probably some way you could get pam_exec or another tool to bump the the timestamp on those files.
    – Zoredache
    Commented Apr 8, 2015 at 16:52
  • I don't believe it would be a good thing at all @Zoredache but once you know the mechanism, as others have pointed out, there are ways to circumvent it. I'm sure Tom is fully aware of the implications though.
    – user9517
    Commented Apr 8, 2015 at 17:45
4

Importantly, typing "sudo" is a conscious action. If, as a malware author, I know my malicious script can "sudo" right after you log in, I can really easily run stuff as root. I know exactly when to strike, and it happens every login. If I have to wait for you to run "sudo" yourself, it makes my life a lot harder - I have to keep trying, and will get spotted in logs etc.

3

Provided you are using an encrypted ssh key, you can use pam_ssh_agent_auth to authenticate to sudo using an ssh-agent. Forwarding is possible. A precompiled package is available in Fedora.

To configure it, modify /etc/pam.d/sudo:

#%PAM-1.0

auth [success=2 default=ignore] pam_ssh_agent_auth.so file=/path/to/sudo_authorized_keys
@include common-auth
@include common-account

session required pam_permit.so
session required pam_limits.so

Modify /etc/sudoers to add:

Defaults env_keep += SSH_AUTH_SOCK

This is to ensure sudo can talk to the ssh-agent.

You won't be prompted for a password. This is as useful as NOPASSWD.

2
  • 1
    In this case, just because you can does not mean you should. Commented Apr 8, 2015 at 19:44
  • 1
    @EsaJokinen click on useful :D
    – dawud
    Commented Apr 8, 2015 at 19:58
0

The purpose of sudo is as security measure. Similar to the UAC in Windows it helps to prevent privilege escalation attacks.

There is no need to run everything in an administrator/root context which is why sudo is there.

This is precisely the same reason that you shouldn't log into everything as root.

Not the answer you're looking for? Browse other questions tagged .