I use sudo to provide permissions and command execution rights to other users under UNIX and Linux operating systems. However, I noticed something strange about sudo. When executing sudo, it will prompt for the user’s password the first time, but sudo no longer requires a password anymore when re-executing it. Why? Is this is a security risk?
The sudo tool records the timestamp by creating a file, when it is executed the first time, sudo won’t need a password if the timestamp has not timed out. The default time out value is 900 seconds (15 minutes).
The timestamp_timeout defines the number of minutes that can elapse before sudo will ask for a password again. The default is 5. Set this to 0 to always prompt for a password. If set to a value less than 0 the userâ€™s timestamp will never expire. Edit /etc/sudoers, enter:
# vi /etc/sudoers
You can also use the visudo command, which edits the sudoers file in a safe fashion:
Set timestamp_timeout as per your requirmehnt or 0 so that it will always prompt for a password:
Save and close the file.
sudo -k command line option
The -k option allow users to create or delete their own timestamps via sudo -v and sudo -k respectively. Run sudo -k to invalidate the timestamp after executing sudo command:
$ sudo -k
The passwd_timeout defines number of minutes before the sudo password prompt times out. The default is 5, set this to 0 for no password timeout. Edit /etc/sudoers, enter: