Sudo is Not Prompting For a Password When Re-executed Second Time

by nixCraft on February 3, 2008 · 5 comments· last updated at May 2, 2012

I use sudo to provide permissions and command execution rights to other users under UNIX and Linux operating systems. However, I noticed something strange about sudo. When executing sudo, it will prompt for the user's password the first time, but sudo no longer requires a password anymore when re-executing it. Why? Is this is a security risk?

The sudo tool records the timestamp by creating a file, when it is executed the first time, sudo won't need a password if the timestamp has not timed out. The default time out value is 900 seconds (15 minutes).

timestamp_timeout Option

The timestamp_timeout defines the number of minutes that can elapse before sudo will ask for a password again. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s timestamp will never expire. Edit /etc/sudoers, enter:
# vi /etc/sudoers
You can also use the visudo command, which edits the sudoers file in a safe fashion:
# visudo
Set timestamp_timeout as per your requirmehnt or 0 so that it will always prompt for a password:
timestamp_timeout 0
Save and close the file.

sudo -k command line option

The -k option allow users to create or delete their own timestamps via sudo -v and sudo -k respectively. Run sudo -k to invalidate the timestamp after executing sudo command:
$ sudo -k

passwd_timeout Option

The passwd_timeout defines number of minutes before the sudo password prompt times out. The default is 5, set this to 0 for no password timeout. Edit /etc/sudoers, enter:
passwd_timeout 2

You should follow me on twitter here or grab rss feed to keep track of new changes.

Featured Articles:

{ 5 comments… read them below or add one }

1 Nik May 24, 2011 at 2:11 pm

I really didn’t understand anything. HOW DO YOU CHANGE the timestamp_timeout ?
Add that in sudoeds ? Nothing happened i got a parse error.

Sudo -k does nothing

HOW ?

2 ET December 22, 2011 at 12:38 pm

“The time out value is 600 seconds (5 minutes) by default. ” – 600sec != 5min…

3 bialy May 2, 2012 at 1:14 pm

I think there are some errors in this article:

1. “vi timestamp_timeout” should be “visudo” or “sudo visudo”.
2. There are no “Defaults” before timeout settings.

4 Vivek Gite May 2, 2012 at 1:33 pm: Thanks for the heads up. According to man page:
timestamp_timeout – Number of minutes that can elapse before sudo will ask for a passwd again. The timeout may include a fractional component if minute granularity is insufficient, for example 2.5. The default is 15. Set this to 0 to always prompt for a password. If set to a value less than 0 the user’s timestamp will never expire. This can be used to allow users to create or delete their own timestamps via sudo -v and sudo -k respectively.
The faq has been updated.
Reply

5 Girish Ram July 6, 2012 at 5:12 pm