5

Our staging server is on an Amazon EC2 instnace. When you ssh into it you can execute a sudo command or sudo su without having to enter a password.

Is there anyway I can require a password from a user when they try a command with sudo? I have a 3rd party dev who needs access and I want to restrict root privileges for them.

I tried setting a password with sudo passwd but I still don't require a password.

~$ sudo passwd root
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
~$ sudo su
/home/ubuntu# exit
~$ sudo passwd
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
~$ sudo su
/home/ubuntu#

UPDATE

I tried requiring the password by running sudo visudo and adding:

ubuntu        ALL=(ALL)       ALL

Now I'm asked for a password but the one which I set does not work! Luckily I created an AMI before I started any of this.

Could the issue be that I don't have a password set for the ubuntu user, I should I have run sudo passwd ubuntu rather than sudo passwd root.


FINAL SOLUTION

Just to clarify, my mistake was that I set the password for the wrong user, I tried to set it for root whereas I should have set it for ubuntu with:

~$ sudo passwd ubuntu

And then updating /etc/sudoers so that the ubuntu user must give their password when running a sudo command. To edit this file you must run sudo visudo and add:

ubuntu        ALL=(ALL)       ALL
  • I think the idea is that in order to get access to the root (ubuntu) user via SSH you would have had to already authenticate the session with the .pem hash, which is theoretically more secure than a password. So that is why they don't require a further password to assume super user privileges. – jacurtis Jul 5 '18 at 15:40
5

If you have a line like

ALL ALL=(ALL) NOPASSWD:ALL

in /etc/sudoers, this will allow all users to sudo without being prompted for passwords. If you uncomment this line you will have to specify which users that are allowed to use sudo, for instance

myuser ALL=(ALL) ALL
  • I just tried something similar to this, see my updated question. /etc/sudoers did not have ALL ALL=(ALL) NOPASSWD:ALL it had myuser ALL=(ALL) ALL – Holly Oct 14 '15 at 9:41
  • 1
    @SteffenNielson Could the issue be that I don't have a password set for the ubuntu user, I should I have run sudo passwd ubuntu rather than sudo passwd root. – Holly Oct 14 '15 at 9:48
  • 1
    From your post, i'm a little insecure if you are trying to use the root user's password when sudoing from "myuser". The idea with sudo is, that you will have to use the user's password itself. Are you doing so? You will definitely have to set a password for your "ubuntu" user with the cmd: sudo passwd ubuntu . – SteffenNielsen Oct 14 '15 at 9:49
  • yes that was it, I was not setting the password on ubuntu. It works nicely now. If you have time would you mind joining me in this chat room. Out of curiosity I triied su www-data but this did not work, I wonder why – Holly Oct 14 '15 at 10:11
  • never mind I get that now too i.e. askubuntu.com/a/124069/138101 – Holly Oct 14 '15 at 10:15
4

Sudo will cache your credentials, so that if you use it multiple times within a short time period, it will only ask for your password the first time.

The man page says:

   timestamp_timeout
                     Number of minutes that can elapse before sudo will
                     ask for a passwd again.  The timeout may include a
                     fractional component if minute granularity is
                     insufficient, for example 2.5.  The default is 5.
                     Set this to 0 to always prompt for a password.  If
                     set to a value less than 0 the user's time stamp
                     will never expire.  This can be used to allow users
                     to create or delete their own time stamps via "sudo
                     -v" and "sudo -k" respectively.

So if you always want to request a password, you simply type sudo visudo to edit the file. Add this line:

Defaults        timestamp_timeout=0

This will require a password to be entered for all sudo commands.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.